EP1616746A2 - Vehicle control system - Google Patents
Vehicle control system Download PDFInfo
- Publication number
- EP1616746A2 EP1616746A2 EP05007078A EP05007078A EP1616746A2 EP 1616746 A2 EP1616746 A2 EP 1616746A2 EP 05007078 A EP05007078 A EP 05007078A EP 05007078 A EP05007078 A EP 05007078A EP 1616746 A2 EP1616746 A2 EP 1616746A2
- Authority
- EP
- European Patent Office
- Prior art keywords
- operation amount
- node
- vehicle
- actuator
- actuator driving
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 230000006854 communication Effects 0.000 claims description 135
- 238000004891 communication Methods 0.000 claims description 134
- 238000012937 correction Methods 0.000 claims description 118
- 238000000034 method Methods 0.000 claims description 108
- 238000001514 detection method Methods 0.000 claims description 74
- 230000007246 mechanism Effects 0.000 claims description 67
- 238000012545 processing Methods 0.000 claims description 56
- 230000004044 response Effects 0.000 claims description 45
- 239000013598 vector Substances 0.000 claims description 38
- 230000005856 abnormality Effects 0.000 claims description 30
- 230000001133 acceleration Effects 0.000 claims description 27
- 238000003745 diagnosis Methods 0.000 claims description 27
- 230000002159 abnormal effect Effects 0.000 claims description 25
- 230000005540 biological transmission Effects 0.000 claims description 24
- 239000000725 suspension Substances 0.000 claims description 21
- 230000009471 action Effects 0.000 claims description 6
- 238000013016 damping Methods 0.000 claims description 4
- 230000009189 diving Effects 0.000 claims 1
- 230000006870 function Effects 0.000 description 166
- 238000010586 diagram Methods 0.000 description 34
- 230000008569 process Effects 0.000 description 24
- 238000012544 monitoring process Methods 0.000 description 14
- 230000004048 modification Effects 0.000 description 12
- 238000012986 modification Methods 0.000 description 12
- 238000011161 development Methods 0.000 description 11
- 238000001914 filtration Methods 0.000 description 11
- 230000001965 increasing effect Effects 0.000 description 10
- 230000015654 memory Effects 0.000 description 10
- 230000008859 change Effects 0.000 description 9
- 238000010977 unit operation Methods 0.000 description 9
- 230000008901 benefit Effects 0.000 description 7
- 238000004092 self-diagnosis Methods 0.000 description 7
- 238000011084 recovery Methods 0.000 description 6
- 238000006243 chemical reaction Methods 0.000 description 5
- 238000013461 design Methods 0.000 description 4
- 230000010365 information processing Effects 0.000 description 4
- 238000005259 measurement Methods 0.000 description 3
- 230000004913 activation Effects 0.000 description 2
- 230000006978 adaptation Effects 0.000 description 2
- 238000012790 confirmation Methods 0.000 description 2
- 230000008878 coupling Effects 0.000 description 2
- 238000010168 coupling process Methods 0.000 description 2
- 238000005859 coupling reaction Methods 0.000 description 2
- 230000003247 decreasing effect Effects 0.000 description 2
- 230000006866 deterioration Effects 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 230000005484 gravity Effects 0.000 description 2
- 230000006872 improvement Effects 0.000 description 2
- 230000001172 regenerating effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 238000000926 separation method Methods 0.000 description 2
- 230000006399 behavior Effects 0.000 description 1
- 230000033228 biological regulation Effects 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 238000002485 combustion reaction Methods 0.000 description 1
- 238000006073 displacement reaction Methods 0.000 description 1
- 230000009977 dual effect Effects 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 230000007257 malfunction Effects 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 230000000644 propagated effect Effects 0.000 description 1
- 230000001681 protective effect Effects 0.000 description 1
- 238000005096 rolling process Methods 0.000 description 1
- 238000005070 sampling Methods 0.000 description 1
- 238000009987 spinning Methods 0.000 description 1
- 230000006641 stabilisation Effects 0.000 description 1
- 238000011105 stabilization Methods 0.000 description 1
- 230000036962 time dependent Effects 0.000 description 1
- 230000007704 transition Effects 0.000 description 1
- 239000013585 weight reducing agent Substances 0.000 description 1
Images
Classifications
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W30/00—Purposes of road vehicle drive control systems not related to the control of a particular sub-unit, e.g. of systems using conjoint control of vehicle sub-units
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
- B60K6/00—Arrangement or mounting of plural diverse prime-movers for mutual or common propulsion, e.g. hybrid propulsion systems comprising electric motors and internal combustion engines ; Control systems therefor, i.e. systems controlling two or more prime movers, or controlling one of these prime movers and any of the transmission, drive or drive units Informative references: mechanical gearings with secondary electric drive F16H3/72; arrangements for handling mechanical energy structurally associated with the dynamo-electric machine H02K7/00; machines comprising structurally interrelated motor and generator parts H02K51/00; dynamo-electric machines not otherwise provided for in H02K see H02K99/00
- B60K6/20—Arrangement or mounting of plural diverse prime-movers for mutual or common propulsion, e.g. hybrid propulsion systems comprising electric motors and internal combustion engines ; Control systems therefor, i.e. systems controlling two or more prime movers, or controlling one of these prime movers and any of the transmission, drive or drive units Informative references: mechanical gearings with secondary electric drive F16H3/72; arrangements for handling mechanical energy structurally associated with the dynamo-electric machine H02K7/00; machines comprising structurally interrelated motor and generator parts H02K51/00; dynamo-electric machines not otherwise provided for in H02K see H02K99/00 the prime-movers consisting of electric motors and internal combustion engines, e.g. HEVs
- B60K6/42—Arrangement or mounting of plural diverse prime-movers for mutual or common propulsion, e.g. hybrid propulsion systems comprising electric motors and internal combustion engines ; Control systems therefor, i.e. systems controlling two or more prime movers, or controlling one of these prime movers and any of the transmission, drive or drive units Informative references: mechanical gearings with secondary electric drive F16H3/72; arrangements for handling mechanical energy structurally associated with the dynamo-electric machine H02K7/00; machines comprising structurally interrelated motor and generator parts H02K51/00; dynamo-electric machines not otherwise provided for in H02K see H02K99/00 the prime-movers consisting of electric motors and internal combustion engines, e.g. HEVs characterised by the architecture of the hybrid electric vehicle
- B60K6/46—Series type
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60K—ARRANGEMENT OR MOUNTING OF PROPULSION UNITS OR OF TRANSMISSIONS IN VEHICLES; ARRANGEMENT OR MOUNTING OF PLURAL DIVERSE PRIME-MOVERS IN VEHICLES; AUXILIARY DRIVES FOR VEHICLES; INSTRUMENTATION OR DASHBOARDS FOR VEHICLES; ARRANGEMENTS IN CONNECTION WITH COOLING, AIR INTAKE, GAS EXHAUST OR FUEL SUPPLY OF PROPULSION UNITS IN VEHICLES
- B60K6/00—Arrangement or mounting of plural diverse prime-movers for mutual or common propulsion, e.g. hybrid propulsion systems comprising electric motors and internal combustion engines ; Control systems therefor, i.e. systems controlling two or more prime movers, or controlling one of these prime movers and any of the transmission, drive or drive units Informative references: mechanical gearings with secondary electric drive F16H3/72; arrangements for handling mechanical energy structurally associated with the dynamo-electric machine H02K7/00; machines comprising structurally interrelated motor and generator parts H02K51/00; dynamo-electric machines not otherwise provided for in H02K see H02K99/00
- B60K6/20—Arrangement or mounting of plural diverse prime-movers for mutual or common propulsion, e.g. hybrid propulsion systems comprising electric motors and internal combustion engines ; Control systems therefor, i.e. systems controlling two or more prime movers, or controlling one of these prime movers and any of the transmission, drive or drive units Informative references: mechanical gearings with secondary electric drive F16H3/72; arrangements for handling mechanical energy structurally associated with the dynamo-electric machine H02K7/00; machines comprising structurally interrelated motor and generator parts H02K51/00; dynamo-electric machines not otherwise provided for in H02K see H02K99/00 the prime-movers consisting of electric motors and internal combustion engines, e.g. HEVs
- B60K6/50—Architecture of the driveline characterised by arrangement or kind of transmission units
- B60K6/52—Driving a plurality of drive axles, e.g. four-wheel drive
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60L—PROPULSION OF ELECTRICALLY-PROPELLED VEHICLES; SUPPLYING ELECTRIC POWER FOR AUXILIARY EQUIPMENT OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRODYNAMIC BRAKE SYSTEMS FOR VEHICLES IN GENERAL; MAGNETIC SUSPENSION OR LEVITATION FOR VEHICLES; MONITORING OPERATING VARIABLES OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRIC SAFETY DEVICES FOR ELECTRICALLY-PROPELLED VEHICLES
- B60L15/00—Methods, circuits, or devices for controlling the traction-motor speed of electrically-propelled vehicles
- B60L15/20—Methods, circuits, or devices for controlling the traction-motor speed of electrically-propelled vehicles for control of the vehicle or its driving motor to achieve a desired performance, e.g. speed, torque, programmed variation of speed
- B60L15/2009—Methods, circuits, or devices for controlling the traction-motor speed of electrically-propelled vehicles for control of the vehicle or its driving motor to achieve a desired performance, e.g. speed, torque, programmed variation of speed for braking
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60L—PROPULSION OF ELECTRICALLY-PROPELLED VEHICLES; SUPPLYING ELECTRIC POWER FOR AUXILIARY EQUIPMENT OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRODYNAMIC BRAKE SYSTEMS FOR VEHICLES IN GENERAL; MAGNETIC SUSPENSION OR LEVITATION FOR VEHICLES; MONITORING OPERATING VARIABLES OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRIC SAFETY DEVICES FOR ELECTRICALLY-PROPELLED VEHICLES
- B60L3/00—Electric devices on electrically-propelled vehicles for safety purposes; Monitoring operating variables, e.g. speed, deceleration or energy consumption
- B60L3/0023—Detecting, eliminating, remedying or compensating for drive train abnormalities, e.g. failures within the drive train
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60L—PROPULSION OF ELECTRICALLY-PROPELLED VEHICLES; SUPPLYING ELECTRIC POWER FOR AUXILIARY EQUIPMENT OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRODYNAMIC BRAKE SYSTEMS FOR VEHICLES IN GENERAL; MAGNETIC SUSPENSION OR LEVITATION FOR VEHICLES; MONITORING OPERATING VARIABLES OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRIC SAFETY DEVICES FOR ELECTRICALLY-PROPELLED VEHICLES
- B60L3/00—Electric devices on electrically-propelled vehicles for safety purposes; Monitoring operating variables, e.g. speed, deceleration or energy consumption
- B60L3/0023—Detecting, eliminating, remedying or compensating for drive train abnormalities, e.g. failures within the drive train
- B60L3/003—Detecting, eliminating, remedying or compensating for drive train abnormalities, e.g. failures within the drive train relating to inverters
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60L—PROPULSION OF ELECTRICALLY-PROPELLED VEHICLES; SUPPLYING ELECTRIC POWER FOR AUXILIARY EQUIPMENT OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRODYNAMIC BRAKE SYSTEMS FOR VEHICLES IN GENERAL; MAGNETIC SUSPENSION OR LEVITATION FOR VEHICLES; MONITORING OPERATING VARIABLES OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRIC SAFETY DEVICES FOR ELECTRICALLY-PROPELLED VEHICLES
- B60L3/00—Electric devices on electrically-propelled vehicles for safety purposes; Monitoring operating variables, e.g. speed, deceleration or energy consumption
- B60L3/0023—Detecting, eliminating, remedying or compensating for drive train abnormalities, e.g. failures within the drive train
- B60L3/0076—Detecting, eliminating, remedying or compensating for drive train abnormalities, e.g. failures within the drive train relating to braking
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60L—PROPULSION OF ELECTRICALLY-PROPELLED VEHICLES; SUPPLYING ELECTRIC POWER FOR AUXILIARY EQUIPMENT OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRODYNAMIC BRAKE SYSTEMS FOR VEHICLES IN GENERAL; MAGNETIC SUSPENSION OR LEVITATION FOR VEHICLES; MONITORING OPERATING VARIABLES OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRIC SAFETY DEVICES FOR ELECTRICALLY-PROPELLED VEHICLES
- B60L3/00—Electric devices on electrically-propelled vehicles for safety purposes; Monitoring operating variables, e.g. speed, deceleration or energy consumption
- B60L3/0092—Electric devices on electrically-propelled vehicles for safety purposes; Monitoring operating variables, e.g. speed, deceleration or energy consumption with use of redundant elements for safety purposes
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60T—VEHICLE BRAKE CONTROL SYSTEMS OR PARTS THEREOF; BRAKE CONTROL SYSTEMS OR PARTS THEREOF, IN GENERAL; ARRANGEMENT OF BRAKING ELEMENTS ON VEHICLES IN GENERAL; PORTABLE DEVICES FOR PREVENTING UNWANTED MOVEMENT OF VEHICLES; VEHICLE MODIFICATIONS TO FACILITATE COOLING OF BRAKES
- B60T7/00—Brake-action initiating means
- B60T7/12—Brake-action initiating means for automatic initiation; for initiation not subject to will of driver or passenger
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W10/00—Conjoint control of vehicle sub-units of different type or different function
- B60W10/04—Conjoint control of vehicle sub-units of different type or different function including control of propulsion units
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W10/00—Conjoint control of vehicle sub-units of different type or different function
- B60W10/04—Conjoint control of vehicle sub-units of different type or different function including control of propulsion units
- B60W10/06—Conjoint control of vehicle sub-units of different type or different function including control of propulsion units including control of combustion engines
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W10/00—Conjoint control of vehicle sub-units of different type or different function
- B60W10/04—Conjoint control of vehicle sub-units of different type or different function including control of propulsion units
- B60W10/08—Conjoint control of vehicle sub-units of different type or different function including control of propulsion units including control of electric propulsion units, e.g. motors or generators
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W10/00—Conjoint control of vehicle sub-units of different type or different function
- B60W10/10—Conjoint control of vehicle sub-units of different type or different function including control of change-speed gearings
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W10/00—Conjoint control of vehicle sub-units of different type or different function
- B60W10/18—Conjoint control of vehicle sub-units of different type or different function including control of braking systems
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W10/00—Conjoint control of vehicle sub-units of different type or different function
- B60W10/20—Conjoint control of vehicle sub-units of different type or different function including control of steering systems
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W20/00—Control systems specially adapted for hybrid vehicles
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W40/00—Estimation or calculation of non-directly measurable driving parameters for road vehicle drive control systems not related to the control of a particular sub unit, e.g. by using mathematical models
- B60W40/08—Estimation or calculation of non-directly measurable driving parameters for road vehicle drive control systems not related to the control of a particular sub unit, e.g. by using mathematical models related to drivers or passengers
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W40/00—Estimation or calculation of non-directly measurable driving parameters for road vehicle drive control systems not related to the control of a particular sub unit, e.g. by using mathematical models
- B60W40/10—Estimation or calculation of non-directly measurable driving parameters for road vehicle drive control systems not related to the control of a particular sub unit, e.g. by using mathematical models related to vehicle motion
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
- B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
- B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
- B60W50/0225—Failure correction strategy
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
- B60W50/04—Monitoring the functioning of the control system
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B62—LAND VEHICLES FOR TRAVELLING OTHERWISE THAN ON RAILS
- B62D—MOTOR VEHICLES; TRAILERS
- B62D5/00—Power-assisted or power-driven steering
- B62D5/04—Power-assisted or power-driven steering electrical, e.g. using an electric servo-motor connected to, or forming part of, the steering gear
- B62D5/0457—Power-assisted or power-driven steering electrical, e.g. using an electric servo-motor connected to, or forming part of, the steering gear characterised by control features of the drive means as such
- B62D5/046—Controlling the motor
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B62—LAND VEHICLES FOR TRAVELLING OTHERWISE THAN ON RAILS
- B62D—MOTOR VEHICLES; TRAILERS
- B62D5/00—Power-assisted or power-driven steering
- B62D5/04—Power-assisted or power-driven steering electrical, e.g. using an electric servo-motor connected to, or forming part of, the steering gear
- B62D5/0457—Power-assisted or power-driven steering electrical, e.g. using an electric servo-motor connected to, or forming part of, the steering gear characterised by control features of the drive means as such
- B62D5/0481—Power-assisted or power-driven steering electrical, e.g. using an electric servo-motor connected to, or forming part of, the steering gear characterised by control features of the drive means as such monitoring the steering system, e.g. failures
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B62—LAND VEHICLES FOR TRAVELLING OTHERWISE THAN ON RAILS
- B62D—MOTOR VEHICLES; TRAILERS
- B62D6/00—Arrangements for automatically controlling steering depending on driving conditions sensed and responded to, e.g. control circuits
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60L—PROPULSION OF ELECTRICALLY-PROPELLED VEHICLES; SUPPLYING ELECTRIC POWER FOR AUXILIARY EQUIPMENT OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRODYNAMIC BRAKE SYSTEMS FOR VEHICLES IN GENERAL; MAGNETIC SUSPENSION OR LEVITATION FOR VEHICLES; MONITORING OPERATING VARIABLES OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRIC SAFETY DEVICES FOR ELECTRICALLY-PROPELLED VEHICLES
- B60L2240/00—Control parameters of input or output; Target parameters
- B60L2240/10—Vehicle control parameters
- B60L2240/12—Speed
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60L—PROPULSION OF ELECTRICALLY-PROPELLED VEHICLES; SUPPLYING ELECTRIC POWER FOR AUXILIARY EQUIPMENT OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRODYNAMIC BRAKE SYSTEMS FOR VEHICLES IN GENERAL; MAGNETIC SUSPENSION OR LEVITATION FOR VEHICLES; MONITORING OPERATING VARIABLES OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRIC SAFETY DEVICES FOR ELECTRICALLY-PROPELLED VEHICLES
- B60L2240/00—Control parameters of input or output; Target parameters
- B60L2240/10—Vehicle control parameters
- B60L2240/14—Acceleration
- B60L2240/20—Acceleration angular
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60L—PROPULSION OF ELECTRICALLY-PROPELLED VEHICLES; SUPPLYING ELECTRIC POWER FOR AUXILIARY EQUIPMENT OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRODYNAMIC BRAKE SYSTEMS FOR VEHICLES IN GENERAL; MAGNETIC SUSPENSION OR LEVITATION FOR VEHICLES; MONITORING OPERATING VARIABLES OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRIC SAFETY DEVICES FOR ELECTRICALLY-PROPELLED VEHICLES
- B60L2240/00—Control parameters of input or output; Target parameters
- B60L2240/10—Vehicle control parameters
- B60L2240/24—Steering angle
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60L—PROPULSION OF ELECTRICALLY-PROPELLED VEHICLES; SUPPLYING ELECTRIC POWER FOR AUXILIARY EQUIPMENT OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRODYNAMIC BRAKE SYSTEMS FOR VEHICLES IN GENERAL; MAGNETIC SUSPENSION OR LEVITATION FOR VEHICLES; MONITORING OPERATING VARIABLES OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRIC SAFETY DEVICES FOR ELECTRICALLY-PROPELLED VEHICLES
- B60L2240/00—Control parameters of input or output; Target parameters
- B60L2240/40—Drive Train control parameters
- B60L2240/42—Drive Train control parameters related to electric machines
- B60L2240/423—Torque
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60L—PROPULSION OF ELECTRICALLY-PROPELLED VEHICLES; SUPPLYING ELECTRIC POWER FOR AUXILIARY EQUIPMENT OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRODYNAMIC BRAKE SYSTEMS FOR VEHICLES IN GENERAL; MAGNETIC SUSPENSION OR LEVITATION FOR VEHICLES; MONITORING OPERATING VARIABLES OF ELECTRICALLY-PROPELLED VEHICLES; ELECTRIC SAFETY DEVICES FOR ELECTRICALLY-PROPELLED VEHICLES
- B60L2250/00—Driver interactions
- B60L2250/26—Driver interactions by pedal actuation
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W2510/00—Input parameters relating to a particular sub-units
- B60W2510/20—Steering systems
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W2510/00—Input parameters relating to a particular sub-units
- B60W2510/20—Steering systems
- B60W2510/202—Steering torque
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W2520/00—Input parameters relating to overall vehicle dynamics
- B60W2520/14—Yaw
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W2540/00—Input parameters relating to occupants
- B60W2540/10—Accelerator pedal position
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W2540/00—Input parameters relating to occupants
- B60W2540/12—Brake pedal position
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W2540/00—Input parameters relating to occupants
- B60W2540/18—Steering angle
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B60—VEHICLES IN GENERAL
- B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
- B60W2554/00—Input parameters relating to objects
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0796—Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02T—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO TRANSPORTATION
- Y02T10/00—Road transport of goods or passengers
- Y02T10/60—Other road transportation technologies with climate change mitigation effect
- Y02T10/62—Hybrid vehicles
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02T—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO TRANSPORTATION
- Y02T10/00—Road transport of goods or passengers
- Y02T10/60—Other road transportation technologies with climate change mitigation effect
- Y02T10/64—Electric machine technologies in electromobility
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02T—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO TRANSPORTATION
- Y02T10/00—Road transport of goods or passengers
- Y02T10/60—Other road transportation technologies with climate change mitigation effect
- Y02T10/72—Electric energy management in electromobility
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02T—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO TRANSPORTATION
- Y02T90/00—Enabling technologies or technologies with a potential or indirect contribution to GHG emissions mitigation
- Y02T90/10—Technologies relating to charging of electric vehicles
- Y02T90/16—Information or communication technologies improving the operation of electric vehicles
Definitions
- the present invention relates to a vehicle control system for controlling the running state of a vehicle. More particularly, the present invention relates to a vehicle control system for electronically controlling driving of a prime mover, steering and braking in a vehicle such as an automobile.
- a vehicle control system has intensively been developed in which driver's operations on an accelerator, a steering wheel and a brake are reflected on mechanisms for generating vehicle driving, steering and braking forces under electronic control without resorting to mechanical linkages.
- high reliability is required to ensure that the functions of driving, steering and braking the vehicle are in no way failed.
- control realized with a mechanical mechanism has been replaced by control realized with an electrical mechanism.
- Typical examples are the so-called “Fly-by-Wire” in airplane control and "X-by-Wire” in automotive control.
- a mechanical backup mechanism was initially provided to be ready for the event of a failure.
- the electrical mechanism has been required to have high reliability with a tendency to omit the mechanical backup mechanism.
- the "Steer-by-Wire” for electrical control of steering and the “Brake-by-Wire” for electrical control of braking are required to positively operate without malfunctions and to have high reliability.
- the "Steer-by-Wire” is required to have extremely high reliability because of the absence of a (failsafe) steering position that ensures safety in the event of a failure.
- the merit of the "X-by-Wire” resides in that vehicle safety is improved by electronically controlling the steering and braking operations in an integrated manner.
- This point is represented by the widely-spreading concept "active safety”, i.e., the concept of enhancing safety of an automobile with the so-called vehicle stabilization control (see, e.g., Patent Reference 3: JP-A-10-291489).
- the reliability is improved by providing a dual-redundant master controller that has the functions of ABS (Antilock Brake System), TCS (Transmission Controlled System), etc. (see, e.g., Non-Patent Reference 1: Literature of First "X-by-Wire” Seminar, by D&M Nikkei Mechanical, etc., pp. 3-6, lower left picture in slide 12).
- ABS Antilock Brake System
- TCS Transmission Controlled System
- Another example is intended to realize high reliability by designing a control module for a front wheel brake to continue the normal operation even when an error occurs (so-called "fail-operative"), and designing a control module for a rear wheel brake to stop the function when an error occurs (so-called "fail-silent") (see, e.g., Patent Reference 2: JP-A-2002-347602).
- a system in which an operation amount applied from a driver to a maneuvering means, such as a brake pedal, is converted to an electric signal and the electric signal is transmitted to a control computer provided in a brake mechanism via a communication means, such as a CAN (Controlled Area Network), thereby performing electronic control.
- a maneuvering means such as a brake pedal
- a communication means such as a CAN (Controlled Area Network)
- the above-mentioned vehicle control system is generally known as the "X-by-Wire" system and is expected to realize more intelligent integrated running control, to reduce the vehicle weight, and to increase the flexibility in design by using a computer in comparison with the known system transmitting control forces through mechanical and hydraulic mechanisms.
- signals from sensors for monitoring the operation amounts applied from the driver and the vehicle status are inputted to an electronic control unit serving as one master (i.e., a master ECU), and an engine controller, a brake controller and a steering controller, i.e., actuators for vehicle control, are controlled in an integrated manner. Therefore, if the master ECU is failed, the maneuvering of the vehicle cannot be performed at all. For that reason, the master ECU must have extremely high reliability to ensure safety.
- an entire vehicle is constructed of subsystems such as an engine, a steering apparatus, and a brake.
- an operating means and an actuator are provided in one-to-one relation as represented by pairs of an accelerator and the engine, a steering wheel and the steering apparatus, and a brake pedal and the brake.
- An integrated vehicle control system requires high reliability. In other words, even if a controller, a sensor or an actuator is failed, safe running of a vehicle must be ensured.
- the fail-operative function i.e., operation capability in the event of a failure
- the known technique includes an ECU for controlling an actuator (such as a steering apparatus or a brake) in accordance with a sensor (such as steering wheel or a brake pedal) per subsystem.
- the ECU controls the associated sensor and actuator in a concentrated manner. To provide the fail-operative function in the entire system, therefore, the ECU per subsystem is required to have the fail-operative function. Providing the fail-operative function in the ECU increases the product cost because of the necessity of redundancy, etc.
- the inventors have found it effective, in realizing a highly reliable and low-cost system, to separate the ECU control functions into an integrated vehicle control function, an actuator control function and a sensor control function, to provide necessary and sufficient reliability per function, and to give the actuator control function with an autonomous backup function that is controllable in accordance with sensor information even when an abnormality occurs in the integrated vehicle control function.
- the vehicle control system is operated on the basis of hard real-time processing that satisfies strict time restrictions. In other words, changes in maneuvering of the driver and conditions of road surfaces must be promptly reflected on the control within a limit time.
- the real-time processing within the subsystem can relatively easily be ensured because development of the function is performed per subsystem.
- the known technique has a difficulty in ensuring the real-time processing in the case of integrated control using a plurality of actuators, such as skidding attitude control. More specifically, because information obtained from one sensor is propagated successively through the vehicle control functions for the plural subsystems such as the brake, the steering apparatus and the engine, it is difficult to ensure the operation within a deadline time required for the relevant control.
- the inventors have found it effective, in realizing the real-time integrated control, to separate the control functions into an integrated vehicle ECU and device controllers (i.e., actuator and sensor controllers), and to constitute them to be able to autonomously operate while sharing data.
- an integrated vehicle ECU and device controllers i.e., actuator and sensor controllers
- control logics in each ECU contain two parts in a mixed way, i.e., one corresponding to a logical and abstract control application, and the other corresponding to a device driver for actually controlling the sensor or the actuator.
- That characteristic raises the problem that, whenever a sensor and/or an actuator is added or changed, control tasks, etc. at the subsystem level must be redesigned and the development cost is increased.
- controllers be designed to enable individual sensors and actuators to autonomously operate, and virtual common memories are provided in decentralized vehicle control units.
- the inventors have found it effective to enable each sensor or actuator to broadcast, e.g., status information or a control target value to the common memories via a high-order interface, and to autonomously acquire required data or make control based on the received data.
- the problem in realizing practical use of a vehicle control system with high reliability resides in achieving the high reliability without inviting a noticeable cost increase.
- the known technique cannot be said as providing an optimum system because a master controller and control modules are partly designed to have the fail-operative function with a complicated redundant hardware configuration, for example.
- a vehicle can be avoided from slipping or spinning to prevent an accident by electronically correcting, e.g., the braking operation even when the driver applies a brake beyond a limit set on the vehicle.
- ECU electronice control unit
- the present invention may provide a vehicle control system comprising a sensor slave computer (sensor controller) for outputting a sensor value to a network, a master computer (command controller) for receiving the sensor value, computing a control target value based on the sensor value, and outputting the computed control target value to the same network, and/or an actuator slave computer (actuator controller) for receiving the control target value and operating an actuator.
- a sensor slave computer sensor controller
- command controller command controller
- actuator slave computer actuator slave computer
- the actuator slave computer may receive the sensor value outputted from the sensor slave computer to the same network and may compute a control target value based on the received sensor value, thereby controlling the actuator.
- the present invention may provide a vehicle control system comprising an operation amount generating node for computing an operation amount command value based on driver's demand signals and vehicle status signals from sensors, and/or actuator driving nodes each controlling an actuator in accordance with the operation amount command value from the operation amount generating node, thereby driving, steering and braking a vehicle.
- Each of those nodes may have a failure detecting function and operate such that, when a failure is detected in itself with the failure detecting function, the relevant node does not make any action externally of the relevant node except for notifying that the relevant node is in a failed state.
- the other normal nodes than the failed node may switch over control in accordance with a failure detecting notification from the failed node, thereby continuing normal operation as an entire system.
- Each of the driver's demand detecting sensors may be connected to a communication network, and when a failure of the relevant sensor is detected, the relevant sensor does not make any action externally of the relevant sensor except for notifying that the relevant sensor is in a failed state.
- each of the sensors may comprise a plurality of sensor elements, A/D converters for converting outputs of the plurality of sensor elements to digital values, a match checking function for a plurality of A/D-converted values, a filter function, and/or a communication interface.
- the operation amount generating node may switch over control depending on a failure position so that a vehicle running state is kept stable.
- Each of the actuator driving nodes may have a function of generating an operation amount command value based on the signals from the driver's demand detecting sensors when the operation amount command value is not receivable from the operation amount generating node.
- the operation amount generating node may switch over control from a normal mode to a mode for realizing the operation amount command value generating function so that the vehicle running state is kept stable, when the operation amount command value is not receivable from the operation amount generating node.
- the driver's demand detecting sensors, the operation amount generating node, and/or the actuator driving node may be connected to the same communication network.
- the communication network may comprise a main bus and a backup bus.
- the main bus may be connected to all of the driver's demand detecting sensors, the operation amount generating node and/or the actuator driving nodes.
- the backup bus may be connected to a part of the driver's demand detecting sensors and/or a part of the actuator driving nodes. In the event of a failure of the main bus, the actuator driving nodes operate such that a vehicle running state is kept stable.
- the driver's demand detecting sensors may include a steering angle sensor for measuring a steering wheel rotational angle, a brake pedal position sensor for measuring a brake pedal step-down amount, and/or an accelerator pedal position sensor for measuring an accelerator pedal step-down amount.
- the operation amount generating node may be constituted as a vehicle motion integrated controller and a driving-system integrated controller.
- the vehicle motion integrated controller may interpret a driver's intent based on the signals from the driver's demand detecting sensors and control a vehicle motion in an integrated manner in combination with the signals from the vehicle status detecting sensors.
- the driving-system integrated controller may interpret a driver's intent based on the signals from the driver's demand detecting sensors and control a driving system of the vehicle in an integrated manner in combination with the signals from the vehicle status detecting sensors.
- the actuator driving nodes may be constituted as a steering actuator driving controller for controlling a steering actuator which generates a steering force, a brake actuator driving controller for controlling a brake actuator which generates a braking force, and/or a suspension actuator driving controller for controlling a suspension actuator which adjusts a damping force.
- Those nodes may be connected to the same communication network.
- a radar or a camera for detecting a situation outside the vehicle may be connected to the communication network.
- the accelerator pedal position sensor may be connected to the communication network and may be further directly connected to an engine controller for receiving a torque command value from the driving-system integrated controller and controlling an engine in accordance with the received torque command value.
- At least the brake pedal position sensor may be constituted to enable normal operation to be continued even in the occurrence of a single failure.
- At least the steering angle sensor and the steering actuator driving controller may be constituted to enable normal operation to be continued even in the occurrence of a single failure, and the steering actuator may be installed plural with redundancy.
- a force generated by each of the plurality of steering actuators may be smaller than a force generated by the steering actuator when the steering wheel and the steering force generating mechanism are mechanically coupled to each other.
- the steering actuator driving controller may comprise a plurality of driving nodes with redundancy each constituted such that, when a failure in the relevant node is detected, the relevant node does not make any action externally of the relevant node except for notifying that the relevant node is in a failed state.
- the driving nodes may drive the steering actuators in redundant arrangement independently of one another.
- each of the brake pedal position sensor and the steering angle sensor may be constituted as a set of fail-silent sensors with redundancy each comprising a plurality of sensor elements, A/D converters for converting outputs of the plurality of sensor elements to digital values, a match checking function for a plurality of A/D-converted values, a filter function, and/or a communication interface.
- each of the brake pedal position sensor and the steering angle sensor may be constituted as a fail-operative node comprising at least three sensor elements, A/D converters for converting outputs of the plurality of sensor elements to digital values, a majority decision function for a plurality of A/D-converted values, a filter function, and/or a communication interface.
- the present invention may provide a vehicle control system comprising an operation amount generating node, a correction amount generating node, and/or an actuator driving node.
- the actuator driving node may control the actuator by using, as a control target value, a value obtained by adding the correction amount from the correction amount generating node to the operation amount from the correction amount generating node when the correction amount generating node is normal, and may control the actuator by using, as the control target value, the operation amount from the operation amount generating node when the correction amount generating node is abnormal.
- the actuator can be controlled in accordance with the operation amount from the operation amount generating node although the correction is not performed.
- the present invention may provide a vehicle control system comprising a plurality of actuator driving units for controlling actuators in accordance with a driver's demand and a vehicle status, and/or a communication unit for interconnecting the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- Each of the actuator driving units may have a control method selecting unit for selecting an actuator control method based on an operation state of itself and operation states of the other actuator driving units.
- the present invention may provide a vehicle control system comprising a plurality of actuator driving units for controlling actuators in accordance with a driver's demand and a vehicle status, and/or a communication unit for interconnecting the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- Each of the actuator driving units may have a failure detecting unit for detecting its own failure and notifying the occurrence of the failure to the other actuator driving units via the communication unit, and may have a control method selecting unit for selecting an actuator control method based on the failed state of itself and the failed states of the other actuator driving units.
- the present invention may provide a vehicle control system comprising a plurality of actuator driving units for controlling actuators in accordance with a driver's demand and a vehicle status, and/or a communication unit for interconnecting the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- Each of the actuator driving units may have a control method selecting unit for selecting an actuator control method based on reception states of messages sent from the other actuator driving units via the communication unit.
- the present invention may provide a vehicle control system comprising a plurality of actuator driving units for controlling actuators in accordance with a driver's demand and a vehicle status, and/or a communication unit for interconnecting the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- Each of the actuator driving units may send a message notifying its own operation state to the other actuator driving units via the communication unit, and may have a control method selecting unit for selecting an actuator control method based on whether the messages have been received from the other actuator driving units.
- the present invention may provide a vehicle control system comprising at least one operation amount generating unit for computing operation amount command values based on a driver's demand and a vehicle status, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit, and/or a communication unit for interconnecting the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- Each of the actuator driving units may have a control method selecting unit for selecting an actuator control method based on an operation state of itself, operation states of the other actuator driving units, and an operation state of the operation amount generating unit.
- the present invention may provide a vehicle control system comprising at least one operation amount generating unit for computing operation amount command values based on a driver's demand and a vehicle status, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit, and/or a communication unit for interconnecting the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- the operation amount generating unit may have a failure detecting unit for detecting its own failure and notifying the occurrence of the failure to the actuator driving units or the operation amount generating unit via the communication unit.
- Each of the actuator driving units may have a failure detecting unit for detecting its own failure and notifying the occurrence of the failure to the other actuator driving units or the operation amount generating unit via the communication unit, and may have a control method selecting unit for selecting an actuator control method based on the failed state of itself, the failed states of the other actuator driving units, and the failed state of the operation amount generating unit.
- the present invention may provide a vehicle control system comprising at least one operation amount generating unit for computing operation amount command values based on a driver's demand and a vehicle status, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit, and/or a communication unit for interconnecting the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- Each of the actuator driving units may have a control method selecting unit for selecting an actuator control method based on reception states of messages sent from the other actuator driving units or the operation amount generating unit.
- the present invention may provide a vehicle control system comprising at least one operation amount generating unit for computing operation amount command values based on a driver's demand and a vehicle status, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit, and/or a communication unit for interconnecting the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- the operation amount generating unit may send the operation amount command values to the actuator driving units via the communication unit.
- Each of the actuator driving units may send, upon receiving the operation amount command value, a response message to the operation amount generating unit or the other actuator driving units via the communication unit, and may have a control method selecting unit for selecting an actuator control method based on whether the operation amount command value from the operation amount generating unit or the response messages from the other actuator driving units have been received.
- the present invention may provide a vehicle control system comprising sensor units for detecting a driver's demand and a vehicle status, at least one operation amount generating unit for computing operation amount command values based on information from the sensor units, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit or the information from the sensor units, and/or a communication unit for interconnecting the sensor units, the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- Each of the actuator driving units may have a control method selecting unit for selecting one of a control method using the operation amount command value from the operation amount generating unit, a control method using the information from the sensor units, and a control method of bringing the actuator into a predetermined state based on an operation state of itself, operation states of the other actuator driving units, and an operation state of the operation amount generating unit.
- the present invention may provide a vehicle control system comprising sensor units for detecting a driver's demand and a vehicle status, at least one operation amount generating unit for computing operation amount command values based on information from the sensor units, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit or the information from the sensor units, and/or a communication unit for interconnecting the sensor units, the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- the operation amount generating unit may have a failure detecting unit for detecting its own failure and notifying the occurrence of the failure to the actuator driving units or the operation amount generating unit via the communication unit.
- Each of the actuator driving units may have a failure detecting unit for detecting its own failure and notifying the occurrence of the failure to the other actuator driving units or the operation amount generating unit via the communication unit, and may have a control method selecting unit for selecting one of a control method using the operation amount command value from the operation amount generating unit, a control method using the information from the sensor units, and a control method of bringing the actuator into a predetermined state based on the failed state of itself, the failed states of the other actuator driving units, and the failed state of the operation amount generating unit.
- the present invention may provide a vehicle control system comprising sensor units for detecting a driver's demand and a vehicle status, at least one operation amount generating unit for computing operation amount command values based on information from the sensor units, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit or the information from the sensor units, and/or a communication unit for interconnecting the sensor means, the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- Each of the actuator driving units may have a control method selecting unit for selecting one of a control method using the operation amount command value from the operation amount generating unit, a control method using the information from the sensor units, and a control method of bringing the actuator into a predetermined state based on reception states of messages sent from the other actuator driving units or the operation amount generating unit.
- the present invention may provide a vehicle control system comprising sensor units for detecting a driver's demand and a vehicle status, at least one operation amount generating unit for computing operation amount command values based on information from the sensor units, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit or the information from the sensor units, and/or a communication unit for interconnecting the sensor means, the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle.
- the operation amount generating unit may send the operation amount command values to the actuator driving units via the communication unit.
- Each of the actuator driving units may send, upon receiving the operation amount command value, a response message to the operation amount generating unit or the other actuator driving units via the communication unit, and may have a control method selecting unit for selecting one of a control method using the operation amount command value from the operation amount generating unit, a control method using the information from the sensor units, and a control method of bringing the actuator into a predetermined state based on whether the operation amount command value from the operation amount generating unit or the response messages from the other actuator driving units have been received.
- the present invention may provide a vehicle control system for driving, steering and braking a vehicle, the vehicle control system comprising a node for detecting a driver's demand and outputting a corresponding signal; an operation amount generating node for computing an operation amount command value based on the driver's demand signal and outputting a corresponding signal; and/or an actuator driving node for controlling an actuator in accordance with the operation amount command value from the operation amount generating node.
- Those three nodes may be arranged in a decentralized manner. Each of those three nodes may include a data reception table storing the signals outputted from the other nodes and has a function of detecting a failure of the other nodes by determining data stored in the data reception table.
- the present invention may provide a vehicle control system, wherein the data reception table includes information representing the time of each message.
- Each node may have a function of determining that a message transmission source or a communication path does not operate normally or has recovered to a normal state, when a time delay is larger than a predetermined value.
- the present invention may provide a vehicle control system wherein the data reception table includes a failure vote section.
- Each node may have a function of identifying a failed node or a node having recovered to a normal state in accordance with a predetermined algorithm.
- the present invention may provide a vehicle control system, wherein each node outputs, as failure votes, failure diagnosis information of the other nodes so that failure determination results of the individual nodes are shared by all the nodes.
- the vehicle control system of the present invention even if the operation amount generating unit or any of the actuator driving units becomes uncontrollable, the vehicle control can safely be continued using the other actuator driving units. It is therefore possible to ensure high reliability, real-time processing, and expandability with a simplified ECU configuration and a low cost without increasing a degree of redundancy of individual controllers beyond the least necessary level.
- the vehicle control system comprises a master computer (command controller) 1, a sensor slave computer (sensor controller) 2, and an actuator slave computer (actuator controller) 3. These computers are interconnected to perform two-way data communication among them via a wired or wireless network N1 of bus, mesh, star, ring or any other suitable type.
- the master computer 1 is a command controller for computing a control target value and includes a master control function (master control means) 1A.
- the sensor slave computer 2 is connected to a sensor 4 for monitoring (measuring) the status of a control target.
- the sensor slave computer 2 includes a sensor processing function (sensor processing means) 2A for processing a sensor signal from the sensor 4.
- the actuator slave computer 3 is a slave computer for controlling the actuator 5, and it includes an actuator control function (actuator control means) 3A for controlling the actuator 5 in accordance with the control target value from the master computer 1 and a simplified master function (control target value generating means) 3B for computing the control target value.
- actuator control function actuator control means
- control target value generating means control target value generating means
- the measured-sensor-value data flow D2 is a data flow of the measured sensor value outputted from the sensor slave computer 2.
- the measured sensor value outputted from the sensor slave computer 2 is received by both the master function 1A of the master computer 1 and the simplified master function 3B of the actuator slave computer 3.
- the control-target-value data flow D1 is a data flow of the control target value outputted from the master computer 1.
- the control target value outputted from the master computer 1 is received by the actuator control function 3A of the actuator slave computer 3.
- the actuator slave computer 3 controls the actuator 5 in accordance with the control target value received by the actuator control function 3A from the master computer 1 via the data flow D1.
- the actuator slave computer 3 controls the actuator 5 in accordance with the control target value computed by the simplified master function 3B. More specifically, the simplified master function 3B computes the control target value based on the measured sensor value obtained via the data flow D2, and the actuator control function 3A controls the actuator 5 in accordance with the result computed by the simplified master function 3B, i.e., the control target value, which is obtained via a data flow D3B inside the actuator slave computer 3.
- the actuator control can be continued in accordance with result computed by the simplified master function 3B. It is therefore possible to reflect the operation applied from the driver and changes of the vehicle status on the control, and to realize a vehicle control system with high reliability.
- Fig. 1 shows the master computer 1 as one computer
- the master control function may be divided into a plurality of functions, and a plurality of computers may be used to execute the divided functions.
- the master computer is embodied as a vehicle motion integrated control unit 10 for controlling the motion of an entire vehicle in an integrated manner.
- the sensor slave computer is embodied as including a steering angle instruction unit (steering angle sensor system) 31, a deceleration instruction unit (brake pedal step-down amount sensor system) 32, and an acceleration instruction unit (accelerator pedal step-down amount sensor system) 33, these instruction units being responsive to operations applied from the driver.
- a steering angle instruction unit steering angle sensor system
- deceleration instruction unit brake pedal step-down amount sensor system
- acceleration instruction unit acceleration pedal step-down amount sensor system
- the actuator slave computer is embodied as including a steering amount control unit 11 for controlling a vehicle steering angle, a braking force control unit 12 for controlling a vehicle braking force, and a driving force control unit 13 for controlling a vehicle driving force.
- the steering angle instruction unit 31, the deceleration instruction unit 32, and the acceleration instruction unit 33, the steering amount control unit 11, the braking force control unit 12, the driving force control unit 13, and the vehicle motion integrated control unit 10 are interconnected via the communication bus N11.
- Fig. 2A shows the data flow when the vehicle motion integrated control unit 10 operates normally.
- numeral D31 denotes an operation amount applied to the steering angle instruction unit 31 from the driver, which is converted to an electric signal by the steering angle instruction unit 31 and outputted to the communication bus N11.
- Numeral D32 denotes an operation amount applied to the deceleration instruction unit 32 from the driver, which is converted to an electric signal by the deceleration instruction unit 32 and outputted to the communication bus N11.
- Numeral D33 denotes an operation amount applied to the acceleration instruction unit 33 from the driver, which is converted to an electric signal by the acceleration instruction unit 33 and outputted to the communication bus N11.
- the vehicle motion integrated control unit 10 receives the steering angle instruction unit operation amount D31, the deceleration instruction unit operation amount D32 and the acceleration instruction unit operation amount D33 via the communication bus N11, and executes computations for controlling the vehicle motion in an integrated manner.
- the vehicle motion integrated control unit 10 outputs a steering amount target value D11, a braking force target value D12, and a driving force target value D13, as target values applied to the respective control units for controlling the vehicle, to the communication bus N11.
- the steering amount control unit 11 receives the steering amount target value D11 via the communication bus N11 and controls a steering system, e.g., a steering mechanism, so that the steering amount target value D11 is realized.
- a steering system e.g., a steering mechanism
- the braking force control unit 12 receives the braking force target value D12 via the communication bus N11 and controls a braking device, e.g., an electric brake, so that the braking force target value D12 is realized.
- a braking device e.g., an electric brake
- the driving force control unit 13 receives the driving force target value D13 via the communication bus N11 and controls a driving force generator and a power transmission system, e.g., an engine, a transmission and an electric motor, so that the driving force target value D13 is realized.
- a driving force generator and a power transmission system e.g., an engine, a transmission and an electric motor
- Fig. 2B shows the data flow when there occurs an error in the vehicle motion integrated control unit 10.
- the steering amount target value D11, the braking force target value D12 and the driving force target value D13 are not outputted to the communication bus N11. In spite of such a situation, the vehicle must be controlled as intended by the driver.
- the steering amount control unit 11 receives the steering angle instruction unit operation amount D31 via the communication bus N11 and controls the steering system, e.g., a steering gear, in accordance with the steering angle instruction unit operation amount D31.
- the braking force control unit 12 receives the deceleration instruction unit operation amount D32 via the communication bus N11 and controls the braking device, e.g., an electric brake, in accordance with the deceleration instruction unit operation amount D32.
- the braking device e.g., an electric brake
- the driving force control unit 13 receives the acceleration instruction unit operation amount D33 via the communication bus N11 and controls the driving force generator, e.g., the engine, the transmission and the electric motor, in accordance with the acceleration instruction unit operation amount D33.
- the driving force generator e.g., the engine, the transmission and the electric motor
- the fact that an error has occurred in the vehicle motion integrated control unit 10 is determined by monitoring, e.g., such an event that no data has been outputted to the communication bus N11 for a certain time.
- the vehicle motion integrated control unit 10 may output a message indicating the occurrence of an error when the error has occurred.
- a control system network N1A corresponds to a communication line in the present invention and is used for communicating data in relation to the vehicle motion control.
- a control system backup network N1B also corresponds to a communication line in the present invention and serves as a backup means used when the control system network N1A is inevitably failed due to, e.g., wire disconnection in the event of a collision accident.
- a steering sensor 41 corresponds to the steering angle instruction unit 31.
- the steering sensor 41 measures the operation amount (steering angle) by which a steering wheel 51 is operated by the driver, and outputs the steering wheel operation amount, as an electric signal, to the control system network N1A and the control system backup network N1B after signal processing such as filtering.
- the steering wheel 51 is connected to a front wheel steering mechanism 71 through a mechanical mechanism so that respective steering angles of front wheels 72R, 72L of a vehicle 50 can be controlled even when a trouble has occurred in the control system network N1A, the steering sensor 41, and an SBW/VGR (Steer-By-Wire/Variable Gear Ratio) driver ECU (Electronic Control Unit) 81 by an inevitable accident.
- SBW/VGR Steer-By-Wire/Variable Gear Ratio
- a brake pedal position sensor 42 corresponds to the deceleration instruction unit 32.
- the brake pedal position sensor 42 measures the operation amount by which a brake pedal 52 is operated by the driver, and outputs the brake pedal operation amount, as an electric signal, to the control system network N1A and the control system backup network N1B after signal processing such as filtering.
- the brake pedal 52 is connected to front wheel brake mechanisms 73 through a hydraulic system so that the braking force applied to the vehicle 50 can be controlled even when a trouble has occurred in the control system network N1A, the brake pedal position sensor 52, BBW (Brake-By-Wire) driver ECU's 83A, 83B, etc. by an inevitable accident.
- BBW Brake-By-Wire
- An accelerator pedal position sensor 43 corresponds to the acceleration instruction unit 33.
- the accelerator pedal position sensor 43 measures the operation amount by which an accelerator pedal 53 is operated by the driver, and outputs the accelerator pedal operation amount, as an electric signal, to the control system network N1A after signal processing such as filtering.
- the accelerator pedal position sensor 43 is connected to an engine control ECU 21 via another communication line so that the engine of the vehicle 50 can be controlled even when a trouble has occurred in the control system network N1A and a DBW (Drive-By-Wire)-system integrated control ECU 20 by an inevitable accident.
- DBW Drive-By-Wire
- a millimeter wave (EHF) radar/camera 44 is used to recognize external conditions of the vehicle 50, for example, by detecting running states of other vehicles in front and rear of the vehicle 50 and recognizing a white line as a boundary of the lane along which that the vehicle 50 is running.
- the millimeter wave radar/camera 44 recognize the external conditions, computes a relative angle, a relative distance, a relative speed, etc. of the other vehicle running ahead, for example, through signal processing, and outputs the computed data as electric signals to the control system network N1A.
- the steering sensor 41, the brake pedal position sensor 42, the accelerator pedal position sensor 43, and the millimeter wave radar/camera 44 are correspond to the sensor slave computer.
- a vehicle motion integrated control ECU 30 serves as the master computer and corresponds to the vehicle motion integrated control unit 10.
- the vehicle motion integrated control ECU 30 receives not only the operation amounts applied from the driver and the running state of the vehicle, which are outputted to the control system network N1A, but also values of measured by the sensors associated with the vehicle motion integrated control ECU 30, and manages the motion of the vehicle 50 in an integrated manner. Then, it outputs the control target values for the driving force control unit, the braking force control unit, the steering amount control unit, a suspension control unit, a safety device control unit, etc. to the control system network N1A.
- the vehicle motion integrated control ECU 30 has the gateway function between a supervisory network N3 and the control system network N1A.
- Examples of the actuator slave computer include the SBW/VGR driver ECU 81, an SBW driver ECU 82, BBW driver ECU's 83A - 83D, EAS (Electric Active Suspension) driver ECU's 84A - 84D, and an airbag ECU 85.
- the SBW/VGR driver ECU 81 corresponds to the steering angle control unit. It controls an electric motor M1 to thereby control the respective steering angles of front wheels 72R, 72L through a front wheel steering mechanism 71, and also controls an electric motor M5 to thereby control a known steering-system variable gear ratio (VGR) mechanism 54.
- VGR variable gear ratio
- the SBW driver ECU 82 also corresponds to the steering angle control unit and controls an electric motor M2 to thereby control respective steering angles of rear wheels 75R, 75L through a rear wheel steering mechanism 74.
- the BBW driver ECU's 83A, 83B, 83C and 83D correspond to the braking force control unit.
- the BBW driver ECU 83A controls an electric motor M3A to control the hydraulic pressure of a pump P, thereby controlling the braking force applied to the front right wheel 72R through the front wheel brake mechanism 73.
- the BBW driver ECU 83B controls an electric motor M3B to control the hydraulic pressure of a pump P, thereby controlling the braking force applied to the front left wheel 72L through the front wheel brake mechanism 73.
- the BBW driver ECU 83C controls an electric motor M3C to control the hydraulic pressure of a pump P, thereby controlling the braking force applied to the rear right wheel 75R through a rear wheel brake mechanism 76.
- the BBW driver ECU 83D controls an electric motor M3D to control the hydraulic pressure of a pump P, thereby controlling the braking force applied to the rear left wheel 75L through the rear wheel brake mechanism 76.
- the EAS driver ECU's 84A, 84B, 84C and 84D correspond to the suspension control unit and control suspension mechanisms 77, 78 installed in the vehicle 50.
- the EAS driver ECU 84A controls an electric motor M4A to thereby control the suspension length, the spring constant, the attenuation constant, etc. of the front wheel suspension mechanism 77 associated with the front right wheel 72R.
- the EAS driver ECU 84B controls an electric motor M4B to thereby control the suspension length, the spring constant, the attenuation constant, etc. of the front wheel suspension mechanism 77 associated with the front left wheel 72L.
- the EAS driver ECU 84C controls an electric motor M4C to thereby control the suspension length, the spring constant, the attenuation constant, etc. of the rear wheel suspension mechanism 78 associated with the rear right wheel 75R.
- the EAS driver ECU 84D controls an electric motor M4D to thereby control the suspension length, the spring constant, the attenuation constant, etc. of the rear wheel suspension mechanism 78 associated with the rear left wheel 75L.
- the EAS driver ECU's 84A - 84D with the vehicle motion integrated control ECU 30, it is possible, for example, to increase the spring constants of the front wheel suspension mechanisms 77 during the deceleration, thereby preventing the vehicle 50 from inclining forward, to increase the spring constants of the suspension mechanisms on the outer side when the vehicle turns, thereby preventing the vehicle from rolling over, and to reduce the front wheel suspension lengths and increase the rear wheel suspension lengths when the vehicle climbs a slope, thereby lessening an inclination of the vehicle.
- the airbag ECU 85 corresponds to the safety device control unit and controls passenger protective devices such as airbags.
- the DBW-system integrated control ECU 20 corresponds to the driving force control unit.
- the DBW-system integrated control ECU 20 controls devices used for the driving control of the vehicle 50 in an integrated manner, such as an engine control ECU 21, a transmission control ECU 22, an electric motor control ECU 23, and a battery control ECU 24 which are connected to a DBW sub-network N2.
- the vehicle motion integrated control ECU 30 is just required to instruct a final driving force to the DBW-system integrated control ECU 20. It is hence possible to instruct target values regardless of the configurations of devices related to the actual driving control, and to realize a simplified control system.
- the engine control ECU 21 is an ECU for controlling the engine (not shown). It receives target values of an engine shaft torque, an engine revolution speed, etc. from the DBW-system integrated control ECU 20, and controls the engine so that the target values are realized.
- the transmission control ECU 22 is an ECU for controlling the transmission (not shown). It receives target values of shift stages, etc. from the DBW-system integrated control ECU 20, and controls the transmission so that the target values are realized.
- the electric motor control ECU 23 is an ECU for controlling a not-shown electric motor for generating the driving force. It receives target values of an output torque, a rotational speed, etc. from the DBW-system integrated control ECU 20, and controls the engine so that the target values are realized.
- the electric motor control ECU 23 also operates as a driving force generator in the negative direction through regenerative control of the electric motor.
- the battery control ECU 24 is an ECU for controlling a battery (not shown) and control a charged state, etc. of the battery.
- An information system gateway 35 serves as a gateway for connecting an information system network (such as MOST known in the art), which is used for connection to, e.g., a radio communication means (such as a cellular phone), a GPS and a car navigation unit (not shown), and the supervisory network N3 to each other.
- an information system network such as MOST known in the art
- a radio communication means such as a cellular phone
- GPS and a car navigation unit not shown
- supervisory network N3 to each other.
- control system network N1A With the information system network and the control system network N1A interconnected via the gateway function, the control system network N1A can logically be separated from the information system network, thus making it possible to comparatively simply make up a configuration that can easily satisfy demands specific to the control system network N1A, such as real-time processing.
- a body system gateway 36 serves as a gateway for connecting a body system network including door locks, power windows, etc. (not shown) and the supervisory network N3 to each other.
- the control system network N1A can logically be separated from the body system network, thus making it possible to comparatively simply make up a configuration that can easily satisfy demands specific to the control system network N1A, such as real-time processing.
- Fig. 4 shows a data flow when the vehicle motion integrated control ECU 30 operates normally.
- the vehicle motion integrated control ECU 30 comprises a vehicle status estimating section 101, a target status computing section 102, a body operation vector/moment computing section 103, an operation amount computing section 104, and a vehicle parameter memory 105. Then, the ECU 30 receives signals from various sensors S, i.e., the steering sensor 41, the brake pedal position sensor 42, the accelerator pedal position sensor 43, the millimeter wave radar/camera 44, and other sensors such as a wheel speed sensor, a body acceleration sensor and an angular acceleration sensor (which are not shown in Fig. 3).
- sensors S i.e., the steering sensor 41, the brake pedal position sensor 42, the accelerator pedal position sensor 43, the millimeter wave radar/camera 44, and other sensors such as a wheel speed sensor, a body acceleration sensor and an angular acceleration sensor (which are not shown in Fig. 3).
- the vehicle status estimating section 101 estimates the current vehicle status based on the sensor signals.
- the target status computing section 102 computes the target vehicle status to be realized with the control, i.e., the target motion status to be taken by the vehicle, based on the vehicle running state estimated by the vehicle status estimating section 101 and the sensor signals.
- the body operation vector/moment computing section 103 computes a force vector parallel to the vehicle running direction and a moment vector in the rotating direction, which are to be generated on a vehicle body with the control, based on the difference between the current vehicle status estimated by the vehicle status estimating section 101 and the target status computed by the target status computing section 102.
- the operation amount computing section 104 computes the target operation amounts to be realized with the control actuators, such as the BBW driver ECU's 83A - 83D, the DBW-system integrated control ECU 20, the SBW/VRG driver ECU 81, the SBW driver ECU 82, the EAS driver ECU's 84A - 84D, and the airbag ECU 85, based on the force vector and the moment vector computed by the body operation vector/moment computing section 103.
- the control actuators such as the BBW driver ECU's 83A - 83D, the DBW-system integrated control ECU 20, the SBW/VRG driver ECU 81, the SBW driver ECU 82, the EAS driver ECU's 84A - 84D, and the airbag ECU 85.
- the vehicle parameter memory 105 stores vehicle parameters, such as dynamic constants of the vehicle body (e.g., the mass, the rotational inertia, and the center of gravity) and specifications of the control actuators (e.g., the time constant of each actuator, the maximum braking force of the brake, and the maximum steering angle of the steering wheel). These vehicle parameters are referred to when processing is executed in the vehicle status estimating section 101, the target status computing section 102, the body operation vector/moment computing section 103, and the operation amount computing section 104.
- vehicle parameters such as dynamic constants of the vehicle body (e.g., the mass, the rotational inertia, and the center of gravity) and specifications of the control actuators (e.g., the time constant of each actuator, the maximum braking force of the brake, and the maximum steering angle of the steering wheel).
- each driver ECU While an output from the operation amount computing section 104 to each driver ECU is indicated by a single line in Fig. 4, the single line does not means only one value, and also represents one set of controlled variables.
- the BBW driver ECU's 83A - 83D may receive the respective controlled variables instructing braking forces independent per wheel.
- the vehicle motion integrated control ECU 30 comprising the vehicle status estimating section 101, the target status computing section 102, the body operation vector/moment computing section 103, and the operation amount computing section 104, an advantage capable of managing and controlling the vehicle motion in an integrated manner can be obtained.
- the separation of the vehicle status estimating section 101 the following advantage is obtained. For example, when the control actuator configuration of the vehicle is changed, such as when only a power train is changed from the engine type to the hybrid type in vehicles having the same platform, a section for computing dynamic characteristics of the vehicle can be reused and therefore the development efficiency of the control system can be increased.
- the separation of the target status computing section 102 the following advantage is obtained. Even when the vehicle setting is customized depending on individual drivers or when the limits of target values are modified depending on conditions of the road and other vehicles running around the relevant one, only the target status computing section 102 is required to be modified and therefore the development efficiency of the control system can be increased.
- the operation amounts applied to the vehicle body can be computed independently of the configuration of the control systems incorporated in the vehicle.
- the body operation vector/moment computing section 103 is able to compute the force and moment vectors to be generated in a similar manner, and only the operation amount computing section 104 requires to be modified. Therefore, the development efficiency of the control system can be increased.
- the current vehicle status computed by the vehicle status estimating section 101 and the target vehicle status computed by the target status computing section 102 will be described below with reference to Fig. 5.
- the current status and target status of the vehicle are each represented by a status variable 1X in motion of a rigid body on an assumption that the body of the vehicle 50 is a rigid body.
- the status variable 1X means displacements (x, y, z), rotational angles ( ⁇ x, ⁇ y, ⁇ z), speeds (dx/dt, dy/dt, dz/dt), and angular speeds (d ⁇ x/dt, d ⁇ y/dt, d ⁇ z/dt) on a three-dimensional (X-Y-Z) local coordinate system 1G fixed to, for example, the center of gravity of the body of the vehicle 50.
- determination of the status variable 1X is effective in performing more precise control and realizing control with more comfortableness to passengers and high safety.
- a vehicle status estimation flow executed by the vehicle status estimating section 101 will be described below with reference to Fig. 6.
- step S1011 the vehicle status estimating section 101 estimates the vehicle motion status on the local coordinate system 1G fixed to the vehicle.
- step S1012 it estimates the vehicle motion status on a stationary coordinate system fixed to a particular point, e.g., Nihonbashi (one geographical point in Tokyo).
- step S1013 it estimates the situation around a point where the vehicle is running.
- step S1014 it estimates and updates a failed state of the vehicle based on the measured values from the sensors S and the failure self-diagnosis results from the control actuators, such as the BBW driver ECU's 83A - 83D, the DBW-system integrated control ECU 20, the SBW/VRG driver ECU 81, the SBW driver ECU 82, the EAS driver ECU's 84A - 84D, and the airbag ECU 85.
- the control actuators such as the BBW driver ECU's 83A - 83D, the DBW-system integrated control ECU 20, the SBW/VRG driver ECU 81, the SBW driver ECU 82, the EAS driver ECU's 84A - 84D, and the airbag ECU 85.
- a target status computation flow executed by the target status computing section 102 will be described with reference to Fig. 7.
- step S1021 the target status estimating section 102 estimates the vehicle status intended by the driver based on the operation amounts detected by the steering sensor 41, the brake pedal position sensor 42, and the accelerator pedal position sensor 43, as well as the current vehicle status.
- step S1022 it computes limits on the vehicle status based on the surrounding situation of the vehicle, the performance of the vehicle control system, failed states of individual devices, legal regulations, etc. For example, when brake devices are partly failed, a maximum speed is limited within the range in which the vehicle can safely be braked by using the remaining normal brake devices.
- step S1023 it decides the target status variable of the vehicle 50 in conformity with the driver's intent within the range not exceeding the limits set on the vehicle status.
- Fig. 8 shows the operation force and moment vectors computed by the body operation vector/moment computing section 103.
- an operation force vector F(Fx, Fy, Fz) and an operation moment vector ⁇ ( ⁇ x, ⁇ y, ⁇ z) are computed on the local coordinate system 1G fixed to the vehicle. This is advantageous in facilitating conversion to the operation amounts for the control devices fixed to the vehicle.
- the operation amount computing section 104 receives the body operation force vector F and moment vector ⁇ both computed by the body operation vector/moment computing section 103 and computes what controlled variables are to be set as the target values for the actual control devices.
- step S1041 the operation amount computing section 104 distributes the body operation force vector F and moment vector ⁇ into tire forces to be generated for each of tires attached to the vehicle 50. Then, it computes the target values of the controlled variable for the actual control devices based on the allocated tire vectors.
- the motion of the entire vehicle can be controlled in an integrated manner.
- Fig. 10 shows the tire vectors computed in step S1041.
- F FR represents the tire vector to be generated on the front right wheel with the control.
- F FL represents the tire vector to be generated on the front left wheel with the control.
- F RR represents the tire vector to be generated on the rear right wheel with the control.
- F RL represents the tire vector to be generated on the rear left wheel with the control.
- the tire vectors are defined as components on the local coordinate system 1G fixed to the vehicle 50.
- Defining the tire vectors as components on the local coordinate system is advantageous in facilitating conversion to the operation amounts for tire driving axles and the steering mechanisms, which are fixed to the vehicle 50.
- step S1042 the operation amount computing section 104 executes an operation amount allocation process.
- the operation amount allocation process is executed corresponding to the arrangement of the actuators for actually controlling the vehicle.
- Figs. 11A and 11B show details of the operation amount allocation process.
- Fig. 11A shows the operation amount allocation process (step S1042a) when the vehicle 50 has a power train for driving an internal combustion engine or a hybrid engine (HE).
- This operation amount allocation process outputs, based on the tire vectors as inputs, steering amounts as the target values for the SBW/VRG driver ECU 81 and the SBW driver ECU 82, braking torques as the target values for the BBW driver ECU's 83A - 83D, and power train damping/driving torques as the target values for the DBW-system integrated control ECU 20.
- Fig. 11B shows the operation amount allocation process (step S1042b) when the vehicle 50 has a power train of the known in-wheel electric motor type.
- This operation amount allocation process outputs steering amounts as the target values for the SBW/VRG driver ECU 81 and the SBW driver ECU 82, braking torques as the target values for regenerative control of in-wheel electric motors and brake pad control ECU's (not shown), and electric motor driving torques as the target values for in-wheel electric motor control ECU's (not shown) are outputted based on the tire vectors as inputs.
- a front-right wheel driving torque receiving section 201 receives the driving torque to be generated on the front right wheel 72R.
- a front-left wheel driving torque receiving section 202 receives the driving torque to be generated on the front left wheel 72L.
- a rear-right wheel driving torque receiving section 203 receives the driving torque to be generated on the rear right wheel 75R.
- a rear-left wheel driving torque receiving section 204 receives the driving torque to be generated on the rear left wheel 75L.
- a power train operation amount computing section 205 computes values used as the target values in respective ECU's for controlling the actual actuators, and instruct the operation amounts for the engine control ECU 21, the transmission control ECU 22, the electric motor control ECU 23, and the battery control ECU 24.
- a torque to be generated on a drive axle of a driving means is used as a target value for executing control. Therefore, the known control system is not compatible with the DBW-system integrated control ECU 20 for the in-wheel electric motor type in which the driving force can be controlled for each wheel.
- a driving system with a driving means for generating a driving force in a concentrated manner is also designed so as to receive, as the control target value, the driving force for each wheel and to redistribute respective target values to the driving actuators in the DBW-system integrated control ECU 20.
- a command value receiving scheme interface
- DBW-system integrated control ECU for the hybrid system and the DBW-system integrated control ECU for the in-wheel electric motor system.
- the purpose of the autonomous decentralized control platform is to realize high reliability, real-time processing, and expandability in vehicle control at a low cost.
- autonomous decentralized means one of highly reliable decentralized system models used in the control field. In other words, it represents a system in which computing nuclei called nodes corresponding to cells in an organism are loosely coupled with one another via a field, called a data field, where common data is placed.
- an autonomous decentralized control system by using a program enabling each node to autonomously operate independently of other nodes, it is possible to realize a configuration in which a failure in a part of the system does not affect the entire system, and to realize a decentralized system with high reliability and expandability.
- a difficulty is faced in application of the autonomous decentralized concept to an actual system based on the biological model, and a generalized application method has not yet been established up to now. Accordingly, studies must be made on architecture for each application system.
- the autonomous decentralized control platform comprises a data field DF10 providing one feature, i.e., 1) common use of data, and nodes (including a sensor node A20, an actuator node A30, and a controller node A10) capable of providing other three features, i.e., 2) autonomous operation, 3) autonomous management, and 4) autonomous backup.
- the nodes A10, A20 and A30 contain self-monitors (self-monitoring functions) A13, A23 and A33, respectively.
- the controller node A10 starts up a processing routine A11 under a time condition A12 (at a period of, e.g., 10 ms).
- the controller node A10 gets sensor data DA20 from the data field DF10, computes a control target value for the actuator node A30, and broadcasts the computed control target value, as controller data DA10, to the data field DF10.
- the data field DF10 is a common memory space virtually formed on the control network. In the normal state, the data field DF10 holds therein the sensor data DA20 outputted from the sensor node A20 and the controller data (control target values) DA10 outputted from the controller node A10.
- autonomous operation in each node means the function of voluntarily executing processing in accordance with the time condition or its own status without receiving any processing request from the other nodes.
- autonomous management in each node means the function of monitoring its own operation and status by itself, which are concealed from the other nodes.
- autonomous backup in each node means the function of incorporating a capability of simplified control and computing necessary data by itself with the simplified control when there is an abnormality in data required for processing to be executed in it, thereby realizing the least necessary processing.
- the data field DF10 can realize an improvement of expandability adapted for the vehicle control system
- the autonomous operation can realize time-dependently activated operation adapted for the real-time decentralized control
- the autonomous management function and the autonomous backup function can realize status monitoring and trouble resistance of the system to ensure reliability.
- the data field is intended to improve expandability of the vehicle control system.
- the purpose of introducing the data field is to standardize interfaces among the nodes and to facilitate replacement and addition of parts.
- data exchange between the nodes is performed via a data field DF20 that is a virtual common memory defined on the network.
- a data field DF20 that is a virtual common memory defined on the network.
- data defined in the data field DF20 is highly abstractive data that can be standardized at a sensor/actuator level.
- sensor measurement for example, a physical value obtained by multiple measurements and subjected to filtering and floating-point arithmetic is defined in the data field instead of primitive data such as a voltage value.
- actuator control standardized data, e.g., a target braking force applied from a brake, is defined in the data field.
- a brake pedal sensor node A200 measures the step-down amount of a brake pedal SA200 and broadcasts the measured result, as a brake pedal status variable (brake step-down amount) DA200, to the data field DF20 after conversion to a standardized physical quantity.
- a controller node A100 computes target braking forces (only a front-right wheel target braking force DA100 and a front-left wheel target braking force DA101 being shown) for respective wheels, and then broadcasts the computed target braking forces to the data field DF20.
- a front wheel brake actuator node A300 controls a front-left wheel brake actuator AA300 and a rear-left wheel brake actuator AA301.
- the vehicle-to-vehicle distance control function is added to the control architecture shown in Fig. 14A, and the brake controller is modified correspondingly.
- a radar SA210 for measuring the distance between the relevant vehicle and a vehicle running ahead and a radar node A210 for controlling the radar SA210 are added, and a measured vehicle-to-vehicle distance DA210 is broadcast to the data field DF20.
- the controller node A100 computes target braking forces (only a front-right wheel target braking force DA100 and a front-left wheel target braking force DA101 being shown) for the respective wheels, and then broadcasts the computed target braking forces to the data field DF20.
- a front-right wheel brake actuator node A310 controls a front-right wheel brake actuator AA310.
- a front-left wheel brake actuator node A320 controls a front-left wheel brake actuator AA320.
- the radar node A210 can be added as a vehicle-to-vehicle distance measuring node just by adding the data of the "vehicle-to-vehicle distance" in the data field DF20 without affecting the other sensors and actuators.
- the brake actuator node is modified from the front wheel control type to the each wheel independent type, no effects are imposed on the other nodes and the data field DF20.
- the nodes can loosely be coupled with one another and a decentralized system with high expandability can easily be realized.
- the intent of the autonomous operation is to realize the operation based on time-dependent activation, which is easy to predict processing in terms of time, for adaptation to the decentralized real-time processing.
- each node voluntarily starts to execute processing in accordance with a time condition or its own status.
- each node is able to start up the processing in accordance with node operating conditions including not only reception of a message, but also the time condition (time-of-day or period) and a status change (interrupt) of itself.
- each node In a real-time system, it is essential to recognize the status of a system as a control target and to reflect the recognized result on control within a certain time. For that reason, control design is required to be able to design the processing execution time on the end-to-end basis.
- each node On the other hand, each node is required to have the function of continuing its own processing without being affected from an abnormality in any other node. To realize such a decentralized real-time system with high reliability, the node operation must be made autonomous.
- the sensor node A20 starts up a processing routine A21 under a time condition A22 (at a period of, e.g., 10 ms).
- the sensor node A20 reads a measured value of the sensor SA20, converts the measured value to a physical quantity through pre-processing such as filtering and floating-point arithmetic, and broadcasts a resulting sensor data DA20 to the data field DF10.
- the actuator node A30 starts up a processing routine A31 under a specific time condition A32 (at a period of 20 ms).
- the actuator node A30 acquires the sensor data DA20 from the data field DF10, computes a control target value for itself A30, and controls an actuator AA30 so that the computed control target value is realized.
- the time conditions A22, A32 i.e., startup conditions, may be each given as a change of its own node status, e.g., an interrupt depending on the engine revolution.
- the autonomous operation of each node can be realized by enabling the node to voluntarily start up the processing, to acquire necessary data by itself and to execute computation in itself.
- the node operation is of the type activated depending on time or the type activated upon a change of its own node status.
- event-based activation from any other node is no longer required, and design of the worst execution time can very easily be made.
- the processing can be continued without being affected by an abnormality in any other node, a highly reliable system can be realized.
- the autonomous management will be described below.
- the intent of the autonomous management is to ensure high reliability required in the vehicle control. More specifically, the autonomous management enables each of nodes constituting a decentralized system to monitor its own operation and to execute processing (fail-operative/fail-silent) in the event of an abnormality per node. Also, to realize both of high reliability and low cost, the fail-operative function (operation capability in the event of a failure) and the fail-silent function (runaway protection in the event of a failure) are selectively performed as the processing in the event of a failure depending on a target node.
- an ECU per subsystem executes the sensor measurement, computation of vehicle controlled variables, and actuator control.
- many ECU's are required to have the fail-operative function, thus resulting in an increase of the cost.
- Another problem is that, when the mutual monitoring function among ECU's is provided, the coupling among the ECU's becomes too close, thus resulting in a deterioration of the expandability and the development efficiency.
- Fig. 16 shows an outline of the autonomous monitoring.
- a self-monitor A430 is provided in a node A400 to monitor the operation in the normal state (normal function) A410. Then, if there occurs an abnormality, a function stopping process (fail-silent function) A411 is executed.
- nodes which are difficult to back up such as nodes for the brake pedal and the steering wheel, are given with the fail-operative function to be able to continue the operation. Further, when the self-monitoring function is itself failed, the node function is stopped to prevent runaway of the node.
- a highly reliable system can be constructed as an assembly of fail-silent nodes that are comparatively low in cost.
- the fail-operative function at a system level can be realized with a combination with the autonomous backup described below.
- the autonomous backup will be described.
- the intent of the autonomous backup is to ensure high reliability required in the vehicle control. More specifically, the autonomous backup provides a simplified control function to compensate for a failure occurred in the nodes constituting the decentralized vehicle control system.
- autonomous backup means the function of realizing the least necessary control with data sharing among slave nodes when a node having the master function is failed in a logical configuration in which control nodes operate in master-slave relation in a normal state.
- Fig. 17 shows an operation flow in an actuator node.
- the controller node A10 computes the control target value using the measured value from the sensor node A20, and the actuator node A30 controls the actuator AA30 in accordance with the computed control target value (i.e., in a sequence of Yes in step S311 ⁇ step S312 ⁇ step S313).
- the actuator node A30 incorporates a simplified version of the control function of the master node (controller node A10), i.e., a simple controller, A34 (see Fig. 13) and computes a simple control target value based on the measured sensor value while referring to the control target value and the measured sensor value at the same time. If an abnormality occurs in the master node, the function is stopped with the above-described self-monitoring function, and the actuator node A30 determines, in step S311, the occurrence of a failure in the master node by confirming, e.g., an event that the data in the data field DF10 is not updated.
- step S311 If the actuator node A30 determines the failure of the master node, processing is executed in a sequence of No in step S311 ⁇ step S314 ⁇ step S313. As a result, the actuator node A30 backs up the processing, which is required to realize its own function, by itself with the simplified control function A34.
- a highly reliable fail-operative system can be realized as an assembly of fail-silent nodes that are comparatively low in cost.
- Figs. 18A and 18B show a configuration example of the XBW vehicle control system.
- an attention is focused on a vehicle motion integrated control ECU, a brake pedal position sensor, a brake actuator (BBW driver ECU), and a data field.
- the data field is provided on a vehicle control network that is installed according to, e.g., "FlexRay".
- the brake control function in the autonomous decentralized control platform is made up of a brake pedal node (smart sensor) B20, a vehicle motion integrated control node (ECU) (high-performance CPU) B10, and a brake actuator node (smart actuator) B30.
- a brake pedal node smart sensor
- ECU vehicle motion integrated control node
- a brake actuator node smart actuator
- the brake pedal node B20 autonomously starts up periodically and measures the status of the brake pedal position sensor SB20 by using an A/D converter B203.
- the measured value is subjected to filtering and correction processes, etc. in a filtering/correction processing section B202, and then to data standardization in a data standardizing section B204. Thereafter, the brake pedal node B20 broadcasts the data "brake pedal status" to an autonomous decentralized data field DF30 by using a communication driver B201.
- the vehicle motion integrated control node B10 starts up periodically. After the startup, the vehicle motion integrated control node B10 refers to the brake pedal status and other data (such as the yaw rate and the steering angle) in the autonomous decentralized data field DF30 by using the communication driver B101, and estimates the vehicle motion status in a vehicle motion observer B102 and the intent of operation applied from the driver in a driver's intent confirming section B103. Based on the estimation results, an actuator target value generating section B104 computes actuator control target values such as the braking force, the drive axle torque, and the steering angle. Then, the vehicle motion integrated control node B10 broadcasts the computed control target values to the autonomous decentralized data field DF30 by using the communication driver B101.
- actuator target value generating section B104 computes actuator control target values such as the braking force, the drive axle torque, and the steering angle.
- the brake actuator node B30 The operation of the brake actuator node B30 is described here, taking the rear left wheel as an example. As with the other nodes, the brake actuator node B30 also starts up periodically. After the startup, the brake actuator node B30 refers to the control target value, i.e., the target braking force, in the autonomous decentralized data field DF30 by using the communication driver B301. Then, a brake actuator AB30 is controlled in accordance with the target braking force.
- the control target value i.e., the target braking force
- the brake actuator node B30 observes the brake status through an A/D converter B303, and computes a value of the brake control variable in a brake caliper control section B302 based on the difference between the braking force actually generated by the brake and the braking force in the target state, followed by controlling the brake actuator AB30 with a predriver B304.
- the period of the operation referring to the data field and the period of the actuator control operation are not always required to be the same, and the period of the actuator control operation may be set so as to execute the control at a higher speed. This enables the control to be executed in a more appropriate manner adapted for the control time constant of the actuator as a control target.
- the brake pedal node B20 autonomously starts up and executes the processing.
- the processing of the brake pedal node B20 is not affected by the failure of the vehicle motion integrated control node B10.
- the vehicle motion integrated control node B10 executes the fail-silent process. In other words, the node B10 comes into a state where the processing therein is all stopped, looking from the exterior. Accordingly, the actuator control target values in the autonomous decentralized data field DF30 are no longer updated.
- the operation of the brake actuator node B30 in this case is described here, taking the rear left wheel as an example.
- the brake actuator node B30 starts up periodically. After the startup, the brake actuator node B30 refers to the control target value, i.e., the target braking force, in the autonomous decentralized data field DF30. At this time, it detects the failure of the vehicle motion integrated control node B10 based on the fact that data of the target braking force is no longer updated. Detection of the failure causes an autonomous decentralized control function B305 in the brake pedal node B20 to start up.
- the autonomous decentralized control function B305 refers to the brake pedal status in the autonomous decentralized data field DF30 and computes a simple target value.
- the brake caliper control section B302 controls the brake actuator AB30 in accordance with the simple target value computed by the autonomous decentralized control function B305 instead of the control target value computed by the vehicle motion integrated control node B10.
- the simple target value provides a value computed using only the brake pedal status, and differs from the value that is computed by the vehicle motion integrated control node B10 and is adapted for controlling the vehicle behavior.
- the vehicle control system can continue the operation with the respective functions of the data field, the autonomous operation, the autonomous management, and the autonomous backup, i.e., the features of the autonomous decentralized control platform.
- Such an effect is advantageous in realizing a fail-operative vehicle control system in combination with fail-silent nodes, and in constructing a highly reliable system at a lower cost.
- the vehicle control system comprises a sensor 500 for detecting the driver's demand, a sensor 550 for detecting the vehicle status, an actuator 400, an operation amount generating node 100, and an actuator driving node 300.
- the sensor 500 for detecting the driver's demand, the operation amount generating node 100, and the actuator driving node 300 have failure detecting functions 210A, 210B and 210C, respectively.
- the failure detecting function 210C of the actuator driving node 300 has not only the self-diagnosis function, but also the function of detecting a failure of the actuator 400.
- the operation amount generating node 100 computes an operation amount command value 120 based on a driver's demand signal 200 and a vehicle status signal 201.
- the actuator driving node 300 receives the operation amount command value 120 and controls the actuator 400, thereby performing the driving, steering, braking, etc. of the vehicle.
- any of the failure detecting functions 210A, 210B and 210C detects a failure in the corresponding node or the actuator 400, it outputs, to the exterior of the node, a failure detection notification 230 for notifying that the relevant node is in a failed state.
- All of the nodes with the failure detecting functions are designed so as to stop all outputs to the exterior, i.e., so as to become fail-silent, except for outputting the failure detection notification 230 when they are in the failed state.
- Fig. 20 is a functional block diagram of the operation amount generating node 100.
- the operation amount generating node 100 stores a plurality of control logics (control A, control B, and control C) for the vehicle control and is designed to switch over the control logic depending on the position and severity of a failure when it receives the failure detection notification 230 from any other node.
- Fig. 21 is a functional block diagram of the actuator driving node 300.
- the actuator driving node 300 stores a plurality of control logics (control X, control Y, and control Z) for computing the operation target value of the actuator 400 based on the operation amount command value 120 generated by the operation amount generating node 100.
- a controller 320 drives the actuator 400 so that the operation target value is obtained.
- the actuator driving node 300 is designed to switch over the control logic depending on the position and severity of a failure when it receives the failure detection notification 230 from any other node.
- the actuator driving node 300 executes the control X or Y in accordance with the received operation amount command value 120.
- the actuator driving node 300 makes switching-over to execute the control Z for taking in the driver's demand signal 200 and computing the operation amount command value by itself.
- Fig. 22 shows an extracted portion of the vehicle control system, which is in particular related to the brake control and the steering control.
- the vehicle control system of this embodiment includes, as sensors for detecting the driver's demands, a steering angle sensor 41 for measuring the rotational angle of a steering wheel 51 and a brake pedal position sensor 42 for measuring the step-down amount of a brake pedal 52. Also, the vehicle control system includes, as an operation amount generating node, a vehicle motion integrated control ECU 30 for interpreting the driver's intent based on signals from the driver's demand detecting sensors and for controlling the vehicle motion in an integrated manner in combination with signals from other sensors (not shown) for detecting the vehicle status, such as an acceleration sensor, a yaw rate sensor, and a wheel speed sensor.
- the vehicle control system further includes, as actuator driving nodes, an SBW/VGR driver ECU 81 for controlling an electric motor M1 which generates a front wheel steering force and an electric motor M5 which acts on a variable gear ratio (VGR) mechanism mounted to a steering column shaft, an SBW driver ECU 82 for controlling a steering electric motor M2 which generates a rear wheel steering force, and BBW driver ECU's 83A - 83D for controlling brake motors M3A - M3D which generate braking forces for four wheels.
- VGR variable gear ratio
- the sensor for measuring the operation amount applied to the brake pedal from the driver can also be given as a hydraulic sensor for measuring the hydraulic pressure generated upon the brake pedal 52 being stepped down by the driver.
- a communication network comprises a main bus N1A and a backup bus N1B.
- the main bus N1A is connected to all the nodes, and the backup bus N1B is connected to the least necessary nodes related to safety in running of the vehicle, i.e., all other nodes than the vehicle motion integrated control ECU 30 and the rear wheel SBW driver ECU 82.
- all the nodes connected to the backup bus N1B are supplied with at least dual source powers.
- the front wheel SBW/VGR driver ECU 81 and the four wheel BBW driver ECU's 83A - 83D incorporate simplified control logic sections 811, 831, respectively.
- the term "simplified control” means control with a comparatively small processing load, e.g., control for making an electric motor torque command value simply proportional to a sensor signal value.
- the front wheel SBW/VGR driver ECU 81, the rear wheel SBW driver ECU 82, and the four wheel BBW driver ECU's 83A - 83D receive a steering angle command and braking force commands from the vehicle motion integrated control ECU 30 via the communication network, and then control the associated electric motors in accordance with the received command values.
- the steering wheel 51 is mechanically coupled to a front wheel steering mechanism 71, and the brake pedal 52 is connected to front wheel brakes 73 through a hydraulic system as well. Therefore, when electronic control is failed, the driver can directly steer and brake the vehicle by using those backup mechanisms.
- the vehicle motion integrated control ECU 30 outputs a failure detection notification to the main bus N1A.
- the communication network By constituting the communication network to be adapted for time division multiple access (TDMA) such that each node issues an output to the network in a predetermined time slot, the absence of output can be used as indicating the occurrence of a failure instead of the failure detection notification.
- TDMA time division multiple access
- Such a scheme can be realized, for example, by dividing a communication cycle into a data transmission cycle and a diagnosis cycle, and causing all the nodes to output some respective data in order in the diagnosis cycle, as shown in Fig. 23.
- Fig. 23 because no output is issued to the network in the time slot within the diagnosis cycle allocated for a node F, the other nodes can recognize that the node F is failed.
- the front wheel SBW/VGR driver ECU 81 and the rear wheel SBW driver ECU 82 Upon receiving the failure detection notification from the vehicle motion integrated control ECU 30, the front wheel SBW/VGR driver ECU 81 and the rear wheel SBW driver ECU 82 take in the value measured by the steering angle sensor 41 via the network and execute the simplified control.
- each of the four wheel BBW driver ECU's 83A - 83D takes in the value measured by the brake pedal position sensor 42 and executes the simplified control in a simplified control logic section 831.
- the front wheel SBW/VGR driver ECU 81, and the four wheel BBW driver ECU's 83A - 83D execute the simplified control by using the backup bus N1B in a similar manner to the event that the vehicle motion integrated control ECU 30 is failed.
- the vehicle motion integrated control ECU 30 executes control such that the vehicle is stably stopped with the remaining three wheels.
- the driver may directly stop the vehicle by using the backup mechanism.
- the failure of the electric motor is assumed to include failures of a motor rotational position sensor, a current sensor, etc. which are required for the motor control.
- the processing is executed in a similar manner.
- the fail-silent node is simpler in hardware configuration than the fail-operative node capable of continuing the normal operation even if a failure occurs. Accordingly, this embodiment can provide the vehicle control system having higher reliability and a lower cost than the known system.
- the steering angle sensor 41 or the brake pedal position sensor 42 comprises two sensor elements 60A, 60B, A/D converters 61A, 61B for converting respective analog outputs of the sensor elements 60A, 60B to digital values, a failure detecting function 210, a filter function 63, a communication controller 64, a communication driver 65A for outputting a signal to the main bus N1A, and a communication driver 65B for outputting a signal to the backup bus N1B.
- the failure detecting function 210 has a match checking function 62 for determining whether two A/D-converted values from the A/D converters 61A, 61B are matched with each other within a predetermined error range. If the two values are not matched with each other, the communication driver 65A and the communication driver 65B are deactivated to become fail-silent.
- the failure detecting function 210 outputs a trigger signal to the A/D converters 61A, 61B so that A/D conversions of the analog outputs from the sensor elements 60A, 60B are executed at the same time.
- the sensor since the sensor includes the filter function 63, the following advantage is obtained. Even when a sensor signal is sampled at a short period and is subjected to a filtering process such as oversampling, it is no longer required to output data to the communication network in match with the sampling period, whereby traffic of the communication network can be reduced.
- the steering angle sensor 41 or the brake pedal position sensor 42 comprises a main sensor element 60A, a reference sensor element 60B, a failsafe LSI 600, and two communication drivers 65A, 65B.
- the failsafe LSI 600 comprises A/D converters 61A, 61B, CPU's 66A, 66B, communication controllers 64A, 64B, and comparators 62A, 62B, these components being arranged with redundancy, as well as one unit of ROM-RAM 67.
- the failsafe LSI 600 After A/D-converting signals from the sensor elements 60A, 60B, the A/D-converted values are exchanged between the CPU's 66A, 66B so that they are matched with each other. Each of the CPU's 66A, 66B executes a filtering process on the A/D-converted values having been made matched with each other.
- a match between the results of the filtering processes is checked by inputting the outputs of the communication controllers 64A, 64B to the comparators 62A, 62B.
- the communication controllers 64 are provided in two channels, and outputs of the two channels are compared with each other in each of the comparators 62A, 62B.
- the fail-silent sensor node can be constituted at a low cost.
- FIG. 26 A vehicle control system according to a fourth embodiment of the present invention will be described below with reference to Fig. 26. Note that components in Fig. 26 corresponding to those in Fig. 22 are denoted by the same reference numerals as those in Fig. 22 and a description thereof is omitted here.
- this fourth embodiment is constituted such that sensor signals are inputted to an HMI ECU 25, which executes comparison and filtering processes of sensor values and outputs the processed sensor data to the network.
- a steering angle sensor 41A and a brake pedal position sensor 42A are each made up of only two sensor elements.
- the HMI ECU 25 is required to be fail-operative.
- FIG. 27 A vehicle control system according to a fifth embodiment of the present invention will be described below with reference to Fig. 27. Note that components in Fig. 27 corresponding to those in Fig. 22 are denoted by the same reference numerals as those in Fig. 22 and a description thereof is omitted here.
- the vehicle control system of the fifth embodiment has the same node and network configurations as those of the third embodiment, but it differs from the latter in that mechanical coupling is not present between the steering column (steering wheel 51) and the steering force generating mechanism and between the brake pedal 52 and the braking force generating mechanism. Accordingly, the driver cannot steer and brake the vehicle by using the mechanical backup mechanisms as in the third embodiment.
- a steering angle sensor 41B, a brake pedal position sensor 42B, and a SBW driver ECU 81A for the front wheels 72R, 72L are each constituted as a fail-operative node capable of continuing the normal operation in the event of a failure.
- the steering motor for the front wheels 72R, 72L is doubled (as indicated by M1A, M1B).
- the front wheel SBW driver ECU 81A comprises two fail-silent nodes, and these fail-silent nodes control the doubled steering motors M1A, M1B independently of each other.
- the front wheel SBW driver ECU 81A includes a simplified control logic section 811.
- the front wheel SBW driver ECU 81A controls an electric motor M6 acting on a mechanism that generates a reaction force from the road surface on the steering column in a pseudo manner.
- the steering angle sensor 41B and the brake pedal position sensor 42B are each constituted in the doubled form of the fail-silent sensor shown in Fig. 25.
- the fail-silent sensor shown in Fig. 25 may be replaced with a single fail-operative sensor having higher reliability in which the sensor element is tripled and the majority decision function for three sensor signals is additionally provided.
- the vehicle motion integrated control ECU 30 switches over the control so that the vehicle can stably be steered with the remaining steering motor.
- the vehicle is controlled to be able to run stably without disabling the braking and steering functions in the same manner as that described in the third embodiment.
- FIG. 28 A vehicle control system according to a sixth embodiment of the present invention will be described below with reference to Fig. 28. Note that components in Fig. 28 corresponding to those in Figs. 3 and 22 are denoted by the same reference numerals as those in Fig. 22 and a description thereof is omitted here.
- nodes related to the driving system, the safety system, etc. are added to the vehicle control system of the third embodiment so as to represent an entire control system for running of the vehicle. While the illustrated sixth embodiment includes the backup mechanisms for steering and braking, even the vehicle control system not provided with the backup mechanisms for steering and braking can also be constituted in a similar way.
- a main bus N1A Connected to a main bus N1A are not only the nodes related to the steering control and the braking control, which have been described above in connection with the third embodiment, but also a DBW-system integrated control ECU 20 for controlling the driving system of the vehicle in an integrated manner, EAS driver ECU's 84A - 84D for controlling respectively suspension motors M4A - M4D to adjust damping forces, an accelerator pedal position sensor 43 for measuring the step-down amount of an accelerator pedal 53, a millimeter wave (EHF) radar/camera 44 for detecting external conditions of the vehicle, and an airbag ECU 85 for controlling expansion of an airbag.
- EHF millimeter wave
- a front wheel SBW/VGR driver ECU 81 and four wheel BBW driver ECU's 83A - 83D incorporate respectively simplified control logic sections 811, 831 therein.
- the DBW-system integrated control ECU 20 is connected to an engine control ECU 21, a transmission control ECU 22, an electric motor control ECU 23, and a battery control ECU 24 via a network N2.
- the vehicle motion integrated control ECU 30 is connected via a network N3 to an information system gateway 35 that serves as a gateway to the network for controlling devices in an information system, such as a car navigation unit, and to a body system gateway 36 that serves as a gateway to the network for controlling devices in an body system, such as door locks, door mirrors and various meters, thereby transferring data to and from those nodes.
- an information system gateway 35 that serves as a gateway to the network for controlling devices in an information system, such as a car navigation unit
- a body system gateway 36 serves as a gateway to the network for controlling devices in an body system, such as door locks, door mirrors and various meters, thereby transferring data to and from those nodes.
- the airbag ECU 85 is also connected at a not-illustrated end to a safety system network for integration of various sensors and an actuator, which are required for expansion control of the airbag.
- the vehicle motion integrated control ECU 30 interprets the driver's intent based on signals from a steering angle sensor 41, a brake pedal position sensor 42 and the accelerator pedal position sensor 43, and computes the steering angle, the braking forces and the driving forces for realizing an optimum vehicle motion in combination with signals from other sensors (not shown) for detecting the vehicle status, such as an acceleration sensor, a yaw rate sensor, and a wheel speed sensor.
- the vehicle motion integrated control ECU 30 sends steering angle commands to a front wheel SBW/VGR driver ECU 81 and a rear wheel SBW driver ECU 82, sends braking force commands to four wheel BBW driver ECU's 83A - 83D, and sends a driving force command to the DBW-system integrated control ECU 20.
- the DBW-system integrated control ECU 20 receives the driving force command, computes the driving forces to be generated from driving force generators, such as an engine and an electric motor, taking into account energy efficiency, etc., and sends the computed driving force commands to the engine control ECU 21, the electric motor control ECU 23, etc. via the network N2.
- driving force generators such as an engine and an electric motor, taking into account energy efficiency, etc.
- the vehicle motion integrated control ECU 30 can execute control, such as running to follow a vehicle running ahead, lane keeping running, and risk avoiding operation, by employing not only information from the sensors for detecting the driver's demand, but also information from the millimeter wave radar/camera 44 for detecting external conditions of the vehicle.
- the nodes connected to the main bus N1A of the communication network are all constituted to be fail-silent.
- only the least necessary nodes related to safety in running of the vehicle are connected to the backup bus N1B. It is therefore possible to reduce the number of nodes that are each required to have a redundant communication interface, and to reduce the cost.
- the accelerator pedal position sensor 43 is also directly connected to the engine control ECU 21 so that the vehicle can be driven even when one of the main bus N1A, the DBW-system integrated control ECU 20, and the network N2 is failed.
- a vehicle control system according to a seventh embodiment of the present invention will be described below with reference to Figs. 29 and 30.
- An operation amount generating node 610 generates an operation amount 612, and the generated operation amount 612 is sent to an actuator driving node 630.
- a correction amount generating node 620 generates a correction amount 622, and the generated correction amount 622 is sent to the actuator driving node 630.
- the actuator driving node 630 includes a controller 632 and a switch 634.
- the correction amount generating node 620 When the correction amount generating node 620 is normal, the correction amount 622 from the correction amount generating node 620 is added to the operation amount 612 from the operation amount generating node 610, to thereby produce a control target value 635 for control of an actuator 640.
- the operation amount 612 from the operation amount generating node 610 is used as the control target value 635 for control of an actuator 640.
- the control when the correction amount generating node 620 is normal, the control can be performed in a finer manner by using the correction amount, and when the correction amount generating node 620 is failed, the control can be continued without using the correction amount while the function is contracted.
- the correction amount generating node 620 preferably includes a failure detecting function 621.
- the switch 634 of the actuator driving node 630 performs switching operation in accordance with a failure detection result 623 obtained with the failure detecting function 621.
- the correction amount generating node 620 requires higher processing performance than the operation amount generating node 610. This makes it essential in the correction amount generating node 620 to increase the number of parts, to raise the operation frequency (i.e., the processor's clock frequency), and to operate with less electrical and thermal allowances. As a result, the correction amount generating node 620 has a higher failure rate (total of failure rates (in units of "fit") of the parts) than the operation amount generating node 610.
- the correction amount generating node 620 is constituted as a node having a higher processing capability than the operation amount generating node 610.
- the correction amount generating node 620 is constituted as a computer (node) having a higher operation frequency than the operation amount generating node 610.
- the operation amount generating node 610 i.e., the least necessary node to continue the control, is expected to have a lower failure rate than the correction amount generating node 620.
- the operation amount generating node 610 is constituted as a node having the configuration with a lower failure rate than that of the correction amount generating node 620.
- the operation amount generating node 610 preferably has a failure withstand function 611.
- the failure detecting function 621 provided in the correction amount generating node 620 can be practiced in various ways. As shown in Fig. 31, by way of example, the failure detecting function 621 can be realized by providing the correction amount generating node 620 double and comparing outputs of two nodes with each other.
- Such a case can be practiced by a method of comparing correction amounts 622a, 622b outputted from the doubled correction amount generating nodes 620 with each other on the side of the correction amount generating node 620, and transmitting one of the correction amounts 622a, 622b and a failure detection result to the actuator driving node 630, or by a method of, as shown in Fig. 32, transmitting the correction amounts 622a, 622b outputted from the doubled correction amount generating nodes 620 to the actuator driving node 630, and comparing the correction amounts 622a and 622b with each other by a comparison function 631 in the actuator driving node 630, thereby obtaining a failure detection result 623.
- the failure withstand function 611 provided in the operation amount generating node 610 can also be practiced in various ways. As shown in Fig. 31, by way of example, the failure withstand function 611 can be realized by providing the operation amount generating node 610 in triple and selecting one of outputs from three nodes based on the majority decision.
- Such a case can be practiced by a method of selecting one of operation amounts 612a, 612b and 612c outputted from the tripled operation amount generating nodes 610 based on the majority decision beforehand on the side of the operation amount generating node 610, and transmitting the selected operation amount to the actuator driving node 630, or by a method of, as shown in Fig. 32, transmitting the operation amounts 612a, 612b and 612c outputted from the tripled operation amount generating nodes 610 to the actuator driving node 630, and selecting one of the three operation amounts based on the majority decision by a majority decision function 633 provided in the actuator driving node 630.
- the configuration may be modified as shown in Fig. 33. More specifically, a gain varying unit 636 and a ramp generator 637 for controlling a gain of the gain varying unit 636 are provided in the actuator driving node 630. The failure detection result 623 is inputted to the ramp generator 637. Then, the correction amount 622 from the correction amount generating node 620 is multiplied by the variable gain in the gain varying unit 636, and the multiplied value is added to the operation amount 612 from the operation amount generating node 610, thereby producing the control target value 635 for control of an actuator 640. With this modification, in an abnormal state of the correction amount generating node 620, the control target value 635 is gradually changed without abrupt changes.
- Fig. 34 represents the operation of this modification.
- a ramp output 637' from the ramp generator 637 takes a high-level value. Therefore, the correction amount 622 from the correction amount generating node 620 is multiplied by a predetermined high-level gain in the gain varying unit 636, and the multiplied value is added to the operation amount 612 from the operation amount generating node 610, thereby producing the control target value 635 for control of the actuator 640.
- the ramp output 637' starts to gradually change from the high-level value to a low-level value with time upon the change of the failure detecting result 623 from "normal” to "abnormal".
- variable gain to be multiplied by the correction amount 622 from the correction amount generating node 620 in the gain varying unit 636 is also gradually changed from a high-level gain to a low-level gain with time.
- the correction amount 622 from the correction amount generating node 620 which is added to the operation amount 612 for computing the control target value 635, is gradually decreased with time.
- the low-level gain is set to 0 in this modification shown in Fig. 34
- a value of the low-level gain may be decided depending on the severity of a failure occurred in the correction amount generating node 620.
- the ramp output 637' is linearly changed from the high-level value to the low-level value in the illustrated modification
- the change pattern is not limited to a linear form, but it may be set to any suitable form including a curve. In addition, it is desirable that the change pattern be a monotonously decreasing one.
- control target value 635 is gradually changed without undergoing abrupt changes in the abnormal state of the correction amount generating node 620, the driver can be kept away from an unusual feeling in the operation. Also, since there occurs no stepped difference in the control target value 635 with the switching-over of the control, a deterioration of controllability can also be avoided which is otherwise caused due to a delay in response of the driver to the stepped difference in the control target value 635.
- the network configuration may be modified such that the operation amount 612 from the operation amount generating node 610 and the correction amount 622 from the correction amount generating node 620 are transmitted to the actuator driving node 630 via a single communication path (communication bus) 650.
- Information transmitted via a communication path 650 in this modification is, as shown in Fig. 36, subjected to time-division and allocated into a plurality of time slots in one-to-one relation to the nodes from which the information is transmitted. More specifically, the operation amount 612 is transmitted while it is placed in a time slot 614 allocated to the operation amount generating node 610, and the correction amount 622 is transmitted while it is placed in a time slot 624 allocated to the correction amount generating node 620.
- Fig. 37 shows a practical example in which the seventh embodiment is applied to the "Steer-by-Wire" system.
- a steering column (steering wheel) 615 is connected to the operation amount generating node 610 to generate an operation amount 612 that is a steering angle corresponding to the angle by which the steering column 615 is operated by the driver.
- the generated operation amount 612 is transmitted to the actuator driving node 630 via the communication path 650.
- An acceleration sensor/yaw rate sensor 625 is connected to the correction amount generating node 620 to generate a correction amount 622 based on information including a signal from the acceleration sensor/yaw rate sensor 625 and the operation amount 612.
- the generated correction amount 622 is transmitted to the actuator driving node 630 via the communication path 650.
- the actuator driving node 630 controls a steering device 641 by using, as the control target value, a value resulting from adding the correction amount 622 to the operation amount 612.
- the front wheels come out of the grip range and stability of the vehicle is deteriorated if the correction amount 622 is not added.
- the acceleration sensor/yaw rate sensor 625 detects a sideslip or a spin of the vehicle and the correction amount generating node 620 generates the correction amount 622 so as to suppress the sideslip or the spin, driving stability of the vehicle is improved.
- Fig. 38 shows a practical example in which the seventh embodiment is applied to the "Brake-by-Wire" system.
- a brake pedal 616 is connected to the operation amount generating node 610 to generate an operation amount 612 that is a brake stepping-down force corresponding to the operation of the brake pedal 616 applied from the driver.
- the generated operation amount 612 is transmitted to actuator driving nodes 630-1 through 630-4 via the communication path 650.
- An acceleration sensor/yaw rate sensor 625 is connected to the correction amount generating node 620 to generate correction amounts 622-1 through 622-4 for the respective brakes based on information including a signal from the acceleration sensor/yaw rate sensor 625 and the operation amount 612.
- the generated correction amount 622 is transmitted to the actuator driving nodes 630-1 through 630-4 via the communication path 650.
- Fig. 39 shows a practical example in which the seventh embodiment is applied to an integrated system of "Steer-by-Wire" and "Brake-by-Wire”.
- the steering column 615 and the brake pedal 616 are connected to the operation amount generating node 610 to generate an operation amount 612-0 that is a steering angle corresponding to the angle by which the steering column 615 is operated by the driver, and also to generate an operation amount 612-2 that is a brake stepping-down force corresponding to the operation of the brake pedal 616 applied from the driver.
- the generated operation amounts 612-0, 612-2 are transmitted to the actuator driving nodes 630-0 through 630-4 via the communication path 650.
- Correction amounts 622-0 through 622-4 are generated and transmitted to the actuator driving nodes 630-0 through 630-4 in a similar manner to that in the above-described example.
- the actuator driving node 630-0 controls the steering device 641 by using, as the control target value, a value resulting from adding the correction amount 622-0 to the operation amount 612-0.
- a vehicle control system according to an eighth embodiment of the present invention will be described below with reference to Fig. 40.
- the vehicle control system comprises at least one sensor 500 for detecting an operation amount that is applied to an accelerator pedal, a brake pedal, a steering wheel, etc. and represents the driver's demand for the vehicle motion; at least one sensor 550 for detecting a vehicle speed, an acceleration or a yaw rate that represents the vehicle status, or information indicating an external situation, which is acquired using, e.g., electric waves or an image; a plurality of actuators 400 corresponding to a motive power source, brakes, and a steering wheel for realizing driving, braking and steering operations, respectively; an operation amount generating node 100 for generating target operation amounts to control the actuators 400; and a plurality of actuator driving nodes 300 for controlling the actuators 400 in accordance with the target operation amounts generated by the operation amount generating node 100.
- the operation amount generating node 100 may be constituted, though not specifically shown, as a general microcomputer comprising a central processing unit (CPU) for executing programs, a nonvolatile memory (ROM) and a volatile memory (RAM) for storing the programs and data, and an input/output unit (I/O) for connection to the sensor 500, the sensor 550 and the actuator driving nodes 300, these components being interconnected via a two-way bus.
- CPU central processing unit
- ROM nonvolatile memory
- RAM volatile memory
- I/O input/output unit
- the operation amount generating node 100 may further comprise an analog/digital converter (ADC) to which the sensor 500 and the sensor 550 are connected, or comprise a serial communication interface (SCI) to which the sensor 500, the sensor 550 and the actuator driving nodes 300 are connected. Further, those components may be realized as one or a plurality of semiconductor integrated circuits.
- ADC analog/digital converter
- SCI serial communication interface
- the operation amount generating node 100 computes the target operation amount for each actuator 400 based on a driver's demand signal 200 outputted from the sensor 500 and a vehicle status signal 201 outputted from the sensor 550, and then transmits the computed target operation amount, as an operation amount command value 120, to the corresponding actuator driving node 300 via a network.
- the operation amount command value 120 is decided depending on the type of each actuator 400, and it is a target driving force when the actuator 400 is the power source, a target braking force applied to one of four wheels when the actuator 400 is the brake, and a target steering angle when the actuator 400 is the steering wheel.
- Each of the actuator driving nodes 300 may be constituted, though not specifically shown, as a general microcomputer comprising a central processing unit (CPU) for executing programs, a nonvolatile memory (ROM) and a volatile memory (RAM) for storing the programs and data, an input/output unit (I/O) for connection to the sensor 500 and the operation amount generating node 100, these components being interconnected via a two-way bus, and driving circuits connected to the I/O and driving the actuators.
- CPU central processing unit
- ROM nonvolatile memory
- RAM volatile memory
- I/O input/output unit
- the actuator driving node 300 may further comprise an analog/digital converter (ADC) to which the sensor 500 is connected, or comprise a serial communication interface (SCI) to which the sensor 500 and the operation amount generating node 100 are connected. Further, those components may be constituted as one or a plurality of semiconductor integrated circuits.
- ADC analog/digital converter
- SCI serial communication interface
- the actuator driving node 300 includes, though not shown, a sensor for detecting one of the driving force, the braking force and the steering angle to be applied from the actuator 400, or for obtaining information required to estimate one of them, and executes driving control of the actuator 400 so that the driving force, the braking force or the steering angle applied from the actuator 400 is matched with the operation amount command value 120 received from the operation amount generating node 100.
- the actuator driving nodes 300 transmits, to the operation amount generating node 100, the driving force, the braking force or the steering angle that is applied from the actuator 400 and is detected by the sensor.
- the operation amount generating node 100 can compute the target operation amount of each actuator 400.
- the sensor 500, the operation amount generating node 100, and the actuator driving nodes 300 include respectively failure detecting functions 210A, 210B and 210C for detecting their own failures.
- Detection of a failure in the sensor 500 with the failure detecting function 210A can be realized by determining whether the value detected by the sensor 500 departs from a predetermined range, or by employing a plurality of sensors and evaluating detection results through comparison check or majority decision.
- Detection of a failure in the operation amount generating node 100 with the failure detecting function 210B can be realized by resorting to timeout of the CPU with a watch dog timer, bit error detection in the ROM, the RAM and the two-way bus with redundant code, or I/O comparison check, or by employing a plurality of operation amount generating nodes 100 and evaluating respective node outputs through comparison check or majority decision.
- Detection of a failure in the actuator driving node 300 with the failure detecting function 210C can be realized by resorting to timeout of the CPU with a watch dog timer, bit error detection in the ROM, the RAM and the two-way bus with redundant code, or I/O comparison check, or by employing a plurality of operation amount generating nodes 100 and evaluating respective node outputs through comparison check or majority decision.
- the failure detecting function 210C has the function of detecting a failure of the actuator 400 based on a change amount of the driving force, the braking force or the steering angle applied from the actuator 400 or the difference between the operation amount command value 120 and the actual value.
- each of the failure detecting functions 210A, 210B and 210C detects a failure in the relevant node or the associated actuator 400, it outputs, to the operation amount generating node 100 and the other actuator driving nodes 300, a failure detection notification 230 for notifying that the relevant node is in a failed state.
- the operation amount generating node 100, and the actuator driving nodes 300 comes into a failed state, it preferably outputs only the failure detection notification 230 and stops the other outputs. Further, it is preferable that, when the failure detection notification 230 cannot be outputted in a normal manner, the output of the failure detection notification 230 is also stopped.
- each actuator driving node 300 has the control program selecting function (control method selecting means) 220 for selecting a control program (i.e., an actuator control method) in accordance with the failure detection results made by itself, the other actuator driving node(s) 300, and the operation amount generating node 100.
- control program selecting function control method selecting means 220 for selecting a control program (i.e., an actuator control method) in accordance with the failure detection results made by itself, the other actuator driving node(s) 300, and the operation amount generating node 100.
- the control program selecting function 220 selects a control program for controlling the actuator 400 in accordance with the operation amount command value 120 transmitted from the operation amount generating node 100. However, when the operation amount generating node 100 is failed, the control program selecting function 220 selects a control program for controlling the actuator 400 in accordance with the driver's demand signal 200 from the sensor 500. Also, when the relevant actuator driving node 300 or the other particular actuator driving node 300 is failed, the control program selecting function 220 selects a control program for safely stopping the control of the actuator 400.
- the vehicle control can be continued by using the actuator driving node 300 in the normal state.
- the vehicle control system according to this eighth embodiment may be modified, as shown in Fig. 41, such that the operation amount generating node 100, the actuator driving nodes 300, and the sensor 500 are interconnected via a network 600, such as a CAN, for communication among them.
- the operation amount generating node 100, the actuator driving nodes 300, and the sensor 500 can send the operation amount command value 120, the failure detection notification 230, the driver's demand signal 200, and other messages to the desired nodes via the network 600.
- the plurality of nodes can receive the message sent from each node.
- the vehicle control system according to the eighth embodiment may be constituted, as shown in Fig. 42, such that the sensor 550 is also connected as one node to the network 600. This enables the sensor 550 to send the vehicle status signal 201 to the desired node via the network 600. Further, the plurality of nodes can receive the message sent from the sensor 550.
- the vehicle control systems shown in Figs. 41 and 42 may be modified such that a plurality of networks 600 are included for the purpose of improving network reliability with redundancy.
- Fig. 43 is a functional block diagram of the operation amount generating node 100.
- the operation amount generating node 100 stores a plurality of control programs (A, B and C) for the vehicle control in the ROM or RAM and is designed so as to switch over the control program depending on the position and severity of a failure when the operation amount generating node 100 detects its own failure with the failure detecting function 210B or receives the failure detection notification 230 from the sensor 500, the sensor 550 and any of the actuator driving nodes 300.
- A, B and C control programs
- Fig. 44 is a functional block diagram of the actuator driving node 300.
- the actuator driving node 300 stores a plurality of control programs (X, Y and Z) in the ROM or RAM for computing the operation target value of the actuator 400 based on the operation amount command value 120 received from the operation amount generating node 100. More specifically, the actuator driving node 300 stores the control program X for controlling the actuator 400 in accordance with the operation amount command value 120 outputted from the operation amount generating node 100, the control program Y for controlling the actuator 400 in accordance with the driver's demand signal 200 outputted from the sensor 500, and the control program Z for maintaining the actuator 400 in a predetermined state regardless of the operation amount command value 120 and the driver's demand signal 200. Then, the actuator driving node 300 is able to switch over the control program depending on the situation of its own failure or a failure in another node with the control program selecting function 220.
- the operation amount generating node 100 detects its own failure with the failure detecting function, it stops the transmission of the operation amount command value 120 and transmits the failure detection notification 230. If the operation amount generating node 100 cannot transmit the failure detection notification 230 in a normal manner, it further stops the transmission of the failure detection notification 230 as well.
- each of the actuator driving nodes 300 connected to the network 600 can detect the occurrence of a failure in the operation amount generating node 100 by receiving the failure detection notification 230 from the operation amount generating node 100, or detect the occurrence of any abnormality in the operation amount generating node 100 by confirming that the operation amount command value 120 is not received within a preset time.
- the network 600 By constituting the network 600 to be adapted for time division multiple access (TDMA) such that each node transmits a message to the network in a predetermined time slot, the occurrence of any abnormality in the operation amount generating node 100 can be detected by confirming whether data is received or not in the time slot allocated to the operation amount generating node 100 for the transmission of the operation amount command value 120.
- TDMA time division multiple access
- the actuator driving node 300 When the actuator driving node 300 detects the failure detection notification 230 from the operation amount generating node 100 or detects non-reception of the operation amount command value 120, it switches over the control program from (X) to (Y) and takes in the driver's demand signal 200 from the sensor 500 via the network 600, thereby executing control of the vehicle motion control, i.e., control of the driving force, the braking force, the steering angle, etc.
- the vehicle motion control can be continued even if the operation amount generating node 100 is failed.
- the failure of the actuator 400 is assumed to include failures of a rotational position sensor, a current sensor, etc. which are required for the actuator control.
- the actuator driving node 300 In the event of a failure in any of the actuator driving nodes 300 or the actuators 400 provided in one-to-one relation to the brakes of the four wheels, when the actuator driving node 300 detects its own failure with the failure detecting function, it transmits the failure detection notification 230 and switches over the control program from (X) to (Z), thereby releasing the brake for the relevant wheel.
- the operation amount generating node 100 controls the braking force with two or three of the remaining wheels in the normal state.
- the driver may directly apply brake to the vehicle by using a mechanical backup mechanism, such as a hydraulic mechanism.
- the vehicle motion control can be continued even if any of the actuator driving nodes 300 or the actuators 400 provided in one-to-one relation to the brakes of the four wheels is failed.
- the actuator driving node 300 In the event of a failure of the actuator driving node 300 or the actuator 400 provided in association with the steering wheel, when the actuator driving node 300 detects its own failure with the failure detecting function 210C, it transmits the failure detection notification 230 and switches over the control program from (X) to (Z), thereby stopping the steering angle control.
- the driver directly steers the vehicle by using a mechanical backup mechanism, such as a steering column.
- a mechanical backup mechanism such as a steering column.
- plural pairs of the actuator driving node 300 and the actuator 400 are provided in association with the steering wheel, and the steering angle control is continued using at least one pair of the actuator driving node 300 and the actuator 400.
- the vehicle motion control can be continued even if the actuator driving node 300 or the actuator 400 provided in association with the steering wheel is failed.
- the actuator driving node 300 In the event of a failure of the actuator driving node 300 or the actuator 400 provided in association with the driving force, when the actuator driving node 300 detects its own failure with the failure detecting function, it transmits the failure detection notification 230 and switches over the control program from (X) to (Z), thereby stopping the driving force control.
- the vehicle can safely be stopped even if the actuator driving node 300 or the actuator 400 provided in association with the driving force is failed.
- the brakes for all the wheels are released and the driver directly applies a brake to the vehicle by using the mechanical backup mechanism, such as the hydraulic mechanism.
- the mechanical backup mechanism such as the hydraulic mechanism.
- a plurality of brake pedal sensors 500 are provided such that the driver's demand can be detected by at least one of the brake pedal sensors 500.
- the vehicle motion control can be continued even if the brake pedal sensor 500 is failed.
- the steering control is stopped and the driver directly steers the vehicle by using the mechanical backup mechanism, such as the steering column.
- the mechanical backup mechanism is not provided, a plurality of steering wheel sensors 500 are provided such that the driver's demand can be detected by at least one of the steering wheel sensors 500.
- the vehicle motion control can be continued even if the steering wheel sensor 500 is failed.
- the driving force control is stopped and the vehicle is stably stopped.
- a plurality of accelerator pedal sensors 500 are provided such that the driver's demand can be detected by at least one of the accelerator pedal sensors 500.
- the operation amount generating node 100 continues the vehicle motion control in accordance with the vehicle status signal 201 obtained in a normal manner and the driver's demand signal 200 obtained from the sensor 500.
- the actuator driving nodes 300 execute respective control processes independently of one another.
- the actuator driving nodes 300 are each required to be able to detect the failure of the operation amount generating node 100. It is also required that, even when a part of the actuator driving nodes 300 is failed in addition to the vehicle motion integrated control ECU 30, the vehicle can stably be controlled with the remaining actuator driving nodes 300. In particular, if there occurs a difference between the braking forces applied from the brakes for the left and right wheels, the vehicle is apt to spin under the braking in an unbalanced state.
- the operation amount generating node 100 repeatedly executes a brake control process at a certain control period (A).
- the control period is decided depending on a degree of accuracy required for the brake control in the vehicle.
- each of the actuator driving nodes 300 repeatedly executes the braking force control of the actuator 400 at a control period (B) shorter than the control period (A) set for the operation amount generating node 100.
- the reason is that the actuator 400 requires higher accuracy in a current feedback control.
- each actuator driving node 300 repeatedly executes the braking force control at the control period (B) in accordance with the latest operation amount command value 120, and the braking force control is not interrupted by, e.g., a communication process with respect to the operation amount generating node 100.
- Fig. 45 is a time chart showing the operation of the actuator driving node 300.
- the horizontal axis represents the lapse of time in a direction from the left to the right.
- Each actuator driving node 300 repeatedly executes the following process at the control period (B).
- the actuator driving node 300 confirms whether it has received the operation amount command value 120 or the failure detection notification 230 from the operation amount generating node 100 and the driver's demand signal 200 from the sensor 500 (B1: confirmation of reception of the command value and the failure detection notification). Because those items are sent at intervals of the control period (A), it is possible to confirm the reception of the operation amount command value 120 and the driver's demand signal 200 by using a timer that measures the time of the control period (A). As an alternative, the reception of the operation amount command value 120 and the driver's demand signal 200 can also be confirmed by employing a network of the time division multiple access (TDMA) type, and sending and receiving those items in predetermined time slots.
- TDMA time division multiple access
- the actuator driving node 300 sends the braking force of the actuator 400 finally detected in the preceding control period and the diagnosis result of the failure detecting function 210C to the operation amount generating node 100 and the other actuator driving node(s) 300 (B2: sending of a response message).
- the actuator driving node 300 does not receive the operation amount command value 120 in routine of B1 (confirmation of reception of the command value and the failure detection notification) and recognizes the non-reception of the operation amount command value 120 as the failure detection notification 230, it further acknowledges the reception of the failure detection notification 230 together. Those items are sent as one response message in the collected form.
- the actuator driving node 300 selects the control program based on the presence or absence of reception of the operation amount command value 120, the presence or absence of reception of the failure detection notification 230, the presence or absence of a failure of the actuator 400 and in itself, as well as the presence or absence of a response message from the other actuator driving node 300 and the contents of the response message (B3: selection of the control program).
- the control program includes the control program (X) for executing the braking force control in accordance with the operation amount command value 120, the control program (Y) for executing the braking force control in accordance with the driver's demand signal 200, and the control program (Z) for releasing the brakes regardless of the operation amount command value 120 and the driver's demand signal 200.
- One of these control programs is selected.
- condition 1 a failure is detected as a result of diagnosis on itself or the actuator.
- Condition 2 when the relevant actuator driving node 300 has received the failure detection notification 230 from the operation amount generating node 100, the other two or more actuator driving nodes 300 response that they have not received the failure detection notification 230.
- Condition 3 when the relevant actuator driving node 300 has not received the failure detection notification 230 from the operation amount generating node 100, the other two or more actuator driving nodes 300 response that they have received the failure detection notification 230.
- Condition 4 when the relevant actuator driving node 300 has received the operation amount command value 120 from the operation amount generating node 100, the other two or more actuator driving nodes 300 response that they have not received the operation amount command value 120.
- Condition 5 when the relevant actuator driving node 300 has not received the operation amount command value 120 from the operation amount generating node 100, the other two or more actuator driving nodes 300 response that they have received the operation amount command value 120.
- the actuator driving node 300 determines its own abnormal state and selects the control program (Z), thereby releasing the brakes (step S1680).
- the occurrence of an abnormality in the operation amount generating node 100 is determined based on conditions given below (step S1620).
- Condition 6 the relevant actuator driving node 300 has received the failure detection notification 230 from the operation amount generating node 100, and the other two or more actuator driving nodes 300 response that they have also received the failure detection notification 230.
- Condition 7 the relevant actuator driving node 300 has not received the operation amount command value 120 from the operation amount generating node 100, and the other two or more actuator driving nodes 300 response that they have also not received the operation amount command value 120.
- the actuator driving node 300 determines that the operation amount generating node 100 is normal. Then, the node 300 selects the control program (X) (step S1660) to execute the braking force control in accordance with the operation amount command value 120.
- the actuator driving node 300 determines that the operation amount generating node 100 is abnormal. Then, the node 300 determines the occurrence of an abnormality in the other actuator driving node 300 or the associated actuator 400 based on conditions given below (step S1630).
- Condition 8 any other actuator driving node 300 notifies the occurrence of a failure.
- Condition 9 the other one actuator driving node 300 sends no response message.
- Condition 10 when the relevant actuator driving node 300 has received the failure detection notification 230 from the operation amount generating node 100, only the other one actuator driving node 300 responses that it has not received the failure detection notification 230.
- Condition 11 when the relevant actuator driving node 300 has not received the failure detection notification 230 from the operation amount generating node 100, only the other one actuator driving node 300 responses that it has received the failure detection notification 230.
- Condition 12 when the relevant actuator driving node 300 has received the operation amount command value 120 from the operation amount generating node 100, only the other one actuator driving node 300 responses that it has not received the operation amount command value 120.
- Condition 13 when the relevant actuator driving node 300 has not received the operation amount command value 120 from the operation amount generating node 100, only the other one actuator driving node 300 responses that it has received the operation amount command value 120.
- the relevant actuator driving node 300 determines that the other actuator driving nodes 300 and the associated actuators 400 are normal. Then, the node 300 selects the control program (Y) (step S1670) to execute the braking force control in accordance with the driver's demand signal 200.
- the relevant actuator driving node 300 determines that the other actuator driving node 300 or the associated actuator 400 is abnormal. Then, the node 300 refers to a later-described control program selection table (step S1640) and selects the control program (Y) or (Z) (step S1650), thereby avoiding the braking in an unbalanced state.
- the actuator driving node 300 determines, based on the conditions 1 through 13, the occurrence of an abnormality in itself or the associated actuator 400, the occurrence of an abnormality in the operation amount generating node 100, and the occurrence of an abnormality in the other actuator driving node 300 or the associated actuator 400, followed by selecting the control program.
- the occurrence of an abnormality may be determined when the non-reception has been confirmed two or more times.
- the number of times of the non-reception may be coincident among the actuator driving nodes 300 by exchanging the data indicative of the number of times of the non-reception among the actuator driving nodes 300 and making the majority decision on values of the exchanged data.
- Figs. 47A and 47B each show a control program selection table.
- the table shown in Fig. 47A is used in the case of selecting the control program so as to brake the vehicle by using, of the four wheel brakes, the brakes of two front or rear wheels when the other actuator driving node 300 or the associated actuator 400 is abnormal.
- the table shown in Fig. 47B is used in the case of selecting the control program so as to brake the vehicle by using, of the four wheel brakes, the brakes of one front wheel and one rear wheel in diagonal relation when the other actuator driving node 300 or the associated actuator 400 is abnormal.
- brake may of course be applied to the vehicle from the remaining normal actuators 400.
- brake In the absence of the hydraulic backup mechanism, even when the vehicle cannot be braked by using the brake for any of two front or rear wheels or any of one front wheel and one rear wheel in diagonal relation, brake must be applied to the vehicle from the remaining normal actuators 400.
- the engine revolution speed is controlled to reduce the vehicle speed so that the influence of the braking in an unbalanced state is suppressed.
- the actuator driving node 300 computes the braking force and executes the brake control (B4). Thereafter, it takes in the actual braking force and collects failure information (B5).
- Fig. 48 is a time chart showing the operations of the operation amount generating node 100 and the actuator driving node 300 at the start timing of brake control.
- the horizontal axis represents the lapse of time in a direction from the left to the right.
- the operation amount generating node 100 sends a braking start notification to the actuator driving nodes 300 for the four wheels (1810).
- each of the actuator driving nodes 300 Upon receiving the braking start notification, each of the actuator driving nodes 300 executes self-diagnosis on its own failure and failure diagnosis on the actuator 400 with the failure detecting function 210C (1820), and it sends the diagnosis result as a response message to the operation amount generating node 100 (1830). Each actuator driving node 300 receives the diagnosis results sent from the other actuator driving nodes 300 via mutual communication.
- the operation amount generating node 100 receives the diagnosis results from the actuator driving nodes 300 and selects the wheels to be subjected to the brake control depending on the presence or absence of a failed node and the position of the failed node (1840). If any actuator driving node 300 has not sent the diagnosis result, that node is regarded as being failed. Alternatively, the braking start notification may be sent again for prompting the actuator driving nodes 300 to send the diagnosis results once more or several more times.
- the operation amount generating node 100 computes the target operation amount for each of the wheels to be subjected to the brake control (1850), and sends the operation amount command value 120 to the corresponding actuator driving node 300 (1860).
- each actuator driving node 300 Upon receiving the operation amount command value 120, each actuator driving node 300 updates a target value of the braking force control and executes the braking force control of the actuator 400 (1870).
- each actuator driving node 300 sends the results of detection of the braking force applied from the actuator 400 and periodic diagnosis with the failure detecting function 210C, as a response message, to the operation amount generating node 100 at a constant period (1880). At this time, each actuator driving node 300 receives the detection and diagnosis results sent from the other actuator driving nodes 300 via mutual communication.
- Fig. 49 is a time chart showing the operations of the operation amount generating node 100 and the actuator driving node 300 during the brake control.
- the horizontal axis represents the lapse of time in a direction from the left to the right.
- the operation amount generating node 100 executes a series of processing steps given below per control period (A) .
- the operation amount generating node 100 receives the response message from each actuator driving node 300 (1910).
- the operation amount generating node 100 confirms the presence or absence of an abnormality and the position of the abnormality in each actuator driving node 300 and the actuator 400, and selects the actuator driving nodes 300 to be subjected to the brake control (1920).
- the operation amount generating node 100 computes the target operation amount for each of the wheels to be subjected to the brake control (1930), and sends the operation amount command value 120 to the corresponding actuator driving node 300 (1940).
- the brake control is started after the operation amount generating node 100 has detected the step-down of the brake pedal by the driver and has sent the braking start notification to the actuator driving nodes 300 for the four wheels.
- the operation amount generating node 100 may always repeatedly execute the series of processing steps at the control period (A), as shown in Fig. 49, regardless of the presence or absence of the step-down of the brake pedal by the driver.
- Fig. 50 is a flowchart showing a process for selecting wheels on which the brake control is to be executed.
- the operation amount generating node 100 determines the occurrence of an abnormality in itself or based on conditions given below (step S2010).
- Condition 1 a failure is detected as a result of self-diagnosis with the failure detecting function 210B.
- Condition 2 the operation amount generating node 100 does not receive the response messages from the three or more actuator driving nodes 300.
- the operation amount generating node 100 determines itself being abnormal. Then, the node 100 sends the failure detection notification 230 to the actuator driving nodes 300 (step S2040) and stops the transmission of the operation amount command value 120 (step S2050).
- the operation amount generating node 100 determines itself being normal and then determines the occurrence of an abnormality in the actuator driving nodes 300 or the actuators 400 based on conditions given below (step S2020).
- Condition 3 the operation amount generating node 100 receives the failure detection notification 230 from any actuator driving node 300.
- Condition 4 the operation amount generating node 100 does not receive the response message from the two or less actuator driving node 300.
- the operation amount generating node 100 determines that all of the actuator driving nodes 300 and the actuators 140 are normal. Then, the node 100 executes the braking force control for all the four wheels (step S2070).
- the operation amount generating node 100 determines that any actuator driving node 300 or the associated actuator 400 is abnormal. Then, the node 100 refers to a later-described braked wheel selection table (step S2030), and executes the braking force control with the selected wheels (step S2060), thereby avoiding the braking in an unbalanced state.
- the operation amount generating node 100 determines, based on the conditions 1 through 4, the occurrence of an abnormality in itself and the occurrence of an abnormality in any actuator driving node 300 or the associated actuator 400. If the operation amount generating node 100 is normal, it executes the brake control so as to avoid the braking in an unbalanced state by using the normal actuator driving nodes 300. If the operation amount generating node 100 is abnormal itself, it stops the brake control for transition to the autonomous brake control with the actuator driving nodes 300.
- the above conditions depend on detailed specifications of the vehicle system and its components, they may be modified corresponding to the specifications in practical use. Also, instead of determining the occurrence of an abnormality immediately upon detecting the non-reception of the response message from any actuator driving node 300, the occurrence of an abnormality may be determined when the non-reception has been confirmed two or more times.
- Figs. 51A and 51B each show a braked wheel selection tables.
- the table shown in Fig. 51A is used in the case of selecting the braked wheels so as to brake the vehicle by using, of the four wheel brakes, the brakes of two front or rear wheels when any actuator driving node 300 or the associated actuator 400 is abnormal.
- the table shown in Fig. 51B is used in the case of selecting the braked wheels so as to brake the vehicle by using, of the four wheel brakes, the brakes of one front wheel and one rear wheel in diagonal relation when any actuator driving node 300 or the associated actuator 400 is abnormal.
- the operation amount generating node 100 computes the operation amount command value 120 so as to release the brakes applied from all the actuators 400, and the driver brakes the vehicle through the hydraulic mechanism.
- the operation amount command value 120 may of course be computed so that brake is applied to the vehicle from the remaining normal actuators 400.
- brake In the absence of the hydraulic backup mechanism, even when the vehicle cannot be braked by using the brake for any of two front or rear wheels or any of one front wheel and one rear wheel in diagonal relation, brake must be applied to the vehicle from the remaining normal actuators 400.
- the engine revolution speed is controlled to reduce the vehicle speed so that the influence of the braking in an unbalanced state is suppressed.
- Fig. 52 is a time chart showing the operations of the operation amount generating node 100 and the actuator driving node 300 when the actuator driving node 300 or the actuator 400 for the rear left wheel is failed at the start timing of the brake control.
- the horizontal axis represents the lapse of time in a direction from the left to the right.
- This time chart is premised on that the operation amount generating node 100 selects the wheels, on which the braking force control is executed, by referring to the braked wheel selection table shown in Fig. 51A.
- the operation amount generating node 100 sends a braking start notification to the actuator driving nodes 300 for the four wheels (2210).
- each of the actuator driving nodes 300 Upon receiving the braking start notification, each of the actuator driving nodes 300 executes self-diagnosis on its own failure and failure diagnosis on the actuator 400 with the failure detecting function 210C (2220), and it sends the diagnosis result as a response message to the operation amount generating node 100 (2230). At this time, the actuator driving node 300 for the rear left wheel issues a response message to notify the operation amount generating node 100 of that a failure has been detected. Additionally, each actuator driving node 300 receives the diagnosis results sent from the other actuator driving nodes 300 via mutual communication.
- the operation amount generating node 100 receives the diagnosis results from the actuator driving nodes 300, detects the failure of the actuator driving node 300 for the rear left wheel, and selects the wheels such that the brake control is executed with the two front wheels (2240).
- the operation amount generating node 100 computes the target operation amounts for the two front wheels (2250). Further, the node 100 sends the operation amount command values 120 to the actuator driving nodes 300 for the two front wheels, and also sends the operation amount command values 120 to the actuator driving nodes 300 for the two rear wheels in order to command release of the braking forces (2260).
- each of the actuator driving nodes 300 for the two front wheels Upon receiving the operation amount command value 120, each of the actuator driving nodes 300 for the two front wheels updates a target value of the braking force control and executes the braking force control of the actuator 400. Also, upon receiving the operation amount command value 120, the actuator driving node 300 for the rear right wheel similarly updates a target value of the braking force control and executes the braking force control of the actuator 400. However, that node 300 does not actually generate the braking force because the received operation amount command value 120 has a value commanding release of the braking force.
- the actuator driving node 300 for the rear left wheel selects the control program (Z) as a result of detecting its own failure, and therefore does not produce the braking force (2270).
- Fig. 53 is a time chart showing the operations of the operation amount generating node 100 and the actuator driving node 300 when the actuator driving node 300 or the actuator 400 for the rear left wheel is failed during the brake control.
- the horizontal axis represents the lapse of time in a direction from the left to the right.
- This time chart is premised on that the operation amount generating node 100 selects the wheels, on which the braking force control is executed, by referring to the braked wheel selection table shown in Fig. 51A.
- the operation amount generating node 100 receives the response message from each actuator driving node 300.
- the operation amount generating node 100 detects the occurrence of a failure in the actuator driving node 300 for the rear left wheel (2310), and selects the wheels such that the brake control is executed with the two front wheels (2320).
- the operation amount generating node 100 computes the target operation amount for each of the wheels to be subjected to the brake control (2330). Further, the node 100 sends the operation amount command values 120 to the actuator driving nodes 300 for the two front wheels, and also sends the operation amount command values 120 to the actuator driving nodes 300 for the two rear wheels in order command release of the braking forces (2340).
- each of the actuator driving nodes 300 for the two front wheels Upon receiving the operation amount command value 120, each of the actuator driving nodes 300 for the two front wheels updates a target value of the braking force control and executes the braking force control of the actuator 400. Also, upon receiving the operation amount command value 120, the actuator driving node 300 for the rear right wheel similarly updates a target value of the braking force control and executes the braking force control of the actuator 400. However, that node 300 does not actually generate the braking force because the received operation amount command value 120 has a value commanding release of the braking force.
- the actuator driving node 300 for the rear left wheel selects the control program (Z) as a result of detecting its own failure, and therefore does not produce the braking force.
- the operation amount generating node 100 generates the operation amount command values 120 so that the vehicle is braked using the normal actuator driving nodes 300 for the two front or rear wheels. Even in that case, therefore, the vehicle can be avoided from being affected by the braking in an unbalanced state.
- Fig. 54 is a time chart showing the operations of the operation amount generating node 100 and the actuator driving node 300 when the actuator driving node 300 or the actuator 400 for the rear left wheel, which has been temporarily failed, is recovered to the normal state during the brake control.
- the horizontal axis represents the lapse of time in a direction from the left to the right.
- This time chart is premised on that the operation amount generating node 100 selects the wheels, on which the braking force control is executed, by referring to the braked wheel selection table shown in Fig. 51A.
- the operation amount generating node 100 selects the wheels such that the brake control is executed with the two front wheels. Then, the node 100 sends the operation amount command values 120 to the actuator driving nodes 300 for the two front wheels, and also sends the operation amount command values 120 to the actuator driving nodes 300 for the two rear wheels in order to command release of the braking forces (2410).
- Each of the actuator driving nodes 300 executes self-diagnosis on its own failure and failure diagnosis on the actuator 400 with the failure detecting function 210C, and it sends the diagnosis result as a response message to the operation amount generating node 100 (2420).
- the actuator driving node 300 for the rear left wheel switches over the control program from (Z) to (X), and maintains the braking force in the released state in accordance with the operation amount command value 120 to command release of the braking force.
- the node 300 sends a response message to notify the operation amount generating node 100 of that the failure has been eliminated.
- each actuator driving node 300 receives the diagnosis results sent from the other actuator driving nodes 300 via mutual communication.
- the operation amount generating node 100 receives the diagnosis results from the actuator driving nodes 300, detects the restoration of the actuator driving node 300 for the rear left wheel from the failed state, and selects the wheels such that the brake control is executed with the four wheels (2430).
- the operation amount generating node 100 computes the target operation amounts for the four front wheels (2440), and sends the operation amount command values 120 to the actuator driving nodes 300 for the four wheels (2450).
- each of the actuator driving nodes 300 for the two front wheels updates a target value of the braking force control and executes the braking force control of the actuator 400.
- the actuator driving node 300 for the rear right wheel updates a target value of the braking force control and executes the braking force control of the actuator 400.
- the actuator driving node 300 for the rear left wheel updates a target value of the braking force control and executes the braking force control of the actuator 400.
- the vehicle can be recovered to the normal control state without causing the braking in an unbalanced state because the operation amount generating node 100 generates the operation amount command values 120 depending on whether the actuator driving nodes 300 or the actuator 400 is normal or abnormal.
- Fig. 55 is a time chart showing the operation of the actuator driving node 300 when the operation amount generating node 100 is failed during the brake control.
- the horizontal axis represents the lapse of time in a direction from the left to the right.
- This time chart is premised on that the actuator driving node 300 selects the control program based on the control program selection table shown in Fig. 47A.
- the operation amount generating node 100 Upon detecting a failure with the failure detecting function 210B, the operation amount generating node 100 stops the transmission of the operation amount command value 120 and sends the failure detection notification 230 (2510).
- each of the actuator driving nodes 300 Upon receiving the failure detection notification 230, each of the actuator driving nodes 300 sends a response message and confirms the reception of the failure detection notification 230 via mutual communication, thereby determining that the operation amount generating node 100 is abnormal (2520).
- each actuator driving node 300 switches over the control program from (X) to (Y) so that the braking force control is executed in accordance with the driver's demand signal 200.
- each actuator driving node 300 confirms the occurrence of a failure in the operation amount generating node 100 via mutual communication, and all the actuator driving nodes 300 switch over the control program so as to brake the vehicle in accordance with the driver's demand signal 200. Even in that case, therefore, the brake control of the vehicle can be maintained.
- Fig. 56 is a time chart showing the operation of the operation amount generating node 100 and the actuator driving node 300 when the operation amount generating node 100, which has been temporarily failed, is recovered to the normal state during the brake control.
- the horizontal axis represents the lapse of time in a direction from the left to the right.
- This time chart is premised on that the actuator driving node 300 selects the control program based on the control program selection table shown in Fig. 47A.
- each of the actuator driving nodes 300 executes the braking force control in accordance with the driver's demand signal 200 by using the control program (Y).
- the operation amount generating node 100 When the operation amount generating node 100 is recovered from the failed state, it receives the response message from each actuator driving node 300 (2610). By referring to the failure diagnosis result of each actuator driving node 300, which is contained in the response message, the operation amount generating node 100 confirms the presence or absence of an abnormality and the position of the abnormality in each actuator driving node 300 and the actuator 400, and selects the actuator driving nodes 300 to be subjected to the brake control (2620).
- the operation amount generating node 100 computes the target operation amount for each of the wheels to be subjected to the brake control (2630), and sends the operation amount command value 120 to the corresponding actuator driving node 300 (2640). At this time, the operation amount generating node 100 may send a failure recovery notification together to notify each actuator driving node 300 of that the failure has been eliminated.
- each actuator driving node 300 Upon receiving the operation amount command value 120, each actuator driving node 300 sends a response message and confirms the reception of the operation amount command value 120 via mutual communication, thereby determining that the operation amount generating node 100 is normal (2650). At this time, the reception of the failure recovery notification may be used to determine whether the operation amount generating node 100 is normal.
- each actuator driving node 300 switches over the control program from (Y) to (X) so that the braking force control is executed in accordance with the operation amount command value 120.
- Fig. 57 is a time chart showing the operation of the actuator driving node 300 when the operation amount generating node 100 and the actuator driving node 300 or the actuator 400 for the rear left wheel are failed during the brake control.
- the horizontal axis represents the lapse of time in a direction from the left to the right.
- This time chart is premised on that the actuator driving node 300 selects the control program based on the control program selection table shown in Fig. 47A.
- the operation amount generating node 100 Upon detecting a failure with the failure detecting function 210B, the operation amount generating node 100 stops the transmission of the operation amount command value 120 and sends the failure detection notification 230 (2710). On the other hand, upon detecting a failure with the failure detecting function 210C, the actuator driving node 300 for the rear left wheel switches over the control program from (X) to (Z).
- each of the actuator driving nodes 300 Upon receiving the failure detection notification 230, each of the actuator driving nodes 300 sends a response message and confirms the reception of the failure detection notification 230 via mutual communication. At this time, the failed actuator driving node 300 for the rear left wheel issues the response message to notify the other actuator driving nodes 300 of that the failure has been detected therein (2720)
- each of the other actuator driving nodes 300 determines that the operation amount generating node 100 and the actuator driving node 300 for the rear left wheel are abnormal, and then selects the control program based on the control program selection table shown in Fig. 47A.
- the actuator driving nodes 300 for the front left and right wheels switch over the control program from (X) to (Y) so that the braking force control is executed in accordance with the driver's demand signal 200.
- the actuator driving node 300 for the rear right wheel switches over the control program from (X) to (Z) so that the braking force is released.
- each actuator driving node 300 confirms the occurrence of a failure in the operation amount generating node 100 and any actuator driving node 300 via mutual communication, and the normal actuator driving nodes 300 switch over the control program depending on the location of the failed actuator driving nodes 300 so as to execute the braking force control in accordance with the driver's demand signal 200 or command release of the braking force in a proper manner. Even in that case, therefore, the brake control of the vehicle can be maintained while avoiding the braking in an unbalanced state.
- the actuator driving node 300 for the steering angle control sends the failure detection notification to the operation amount generating node 100 and the other actuator driving nodes 300.
- the operation amount generating node 100 Upon receiving the failure detection notification from the actuator driving node 300 for the steering angle control, the operation amount generating node 100 operates as follows.
- the operation amount generating node 100 can continue the steering control by sending the operation amount command value 120 to the normal actuator driving node 300 for the steering angle control.
- the operation amount generating node 100 can also continue the steering control by sending the operation amount command values 120 to the actuator driving nodes 300 for the brake control so that the vehicle is caused to turn due to a difference in braking force between the brakes for the right wheel and the left wheel.
- the operation amount generating node 100 sends the failure detection notification to all the actuator driving nodes 300.
- the actuator driving nodes 300 for the steering angle control can continue the steering control by taking in the driver's demand signal 200 from the sensor 500.
- the actuator driving nodes 300 for the brake control detects the failure of the actuator driving node 300 for the steering angle control by receiving the failure detection notification from the actuator driving node 300 for the steering angle control or by confirming non-reception of a response message from it. Then, the actuator driving nodes 300 for the brake control can make the steering control continued while modifying the respective operation amounts via mutual reference using response messages in accordance with the driver's demand signal 200 from the sensor 500 so that the vehicle is caused to turn due to a difference in braking force between the brakes for the right wheel and the left wheel.
- the present invention is also effectively applicable to a vehicle control system in which the vehicle is controlled only with the actuator driving nodes 300 without using the operation amount generating node 100, as shown in Fig. 58.
- Each of the actuator driving nodes 300 used in the vehicle control system according to this modification controls an associated actuator 400 by selecting the control program (Y) or (Z). This selection of the control program is executed in the same manner as the case where the operation amount generating node 100 is failed in the vehicle control systems according to the above-described embodiments.
- the actuator driving nodes 300 operating independently of one another control their actuators 400 under coordination among them, a safe vehicle control system can be realized even in the vehicle not equipped with the operation amount generating node 100.
- a vehicle control system according to a ninth embodiment of the present invention will be described below with reference to Figs. 59 through 61.
- Fig. 59 shows a basic configuration of the vehicle control system according to the ninth embodiment.
- the vehicle control system comprises a sensor 500 for detecting the driver's demand, an actuator 400, an operation amount generating node 100, and actuator driving nodes 300.
- the sensor 500 for detecting the driver's demand, the operation amount generating node 100, and the actuator driving nodes 300 have the failure detecting functions 210A, 210B and 210C, respectively.
- the failure detecting function 210C of each actuator driving node 300 has not only the self-diagnosis function, but also the function of detecting a failure of the associated actuator 400.
- the operation amount generating node 100 computes an operation amount command value 120 based on a driver's demand signal 200 and a vehicle status signal 201.
- the actuator driving node 300 receives the operation amount command value 120 and controls the actuator 400 to thereby execute driving, steering, braking, etc. of the vehicle.
- each of the failure detecting functions 210A, 210B and 210C detects a failure of its own node or the associated actuator 400, it outputs a failure detection notification 230 to the exterior of the node to notify that its own node is in the failed state.
- each of all those nodes stops any other outputs to the exterior than outputting the failure detection notification 230, namely, it is constituted to be fail-silent.
- each node includes a data reception table 9100. Though not shown in Fig. 59, each node includes a data transmission table as well. Data stored in the data transmission table is output to the other nodes at a period preset in the system. Conversely, data received from the other nodes is temporarily stored in the data reception table and is read for use at a control period in the relevant node.
- the nodes may be interconnected via a bus or network configuration in which a common communication path is used in a time division manner.
- the failure detecting functions 210A, 210B and 210C has not only the function of estimating the nodes of the other nodes based on the contents of the data reception table, but also the function of reporting the estimation results to a plurality of nodes.
- Fig. 60 shows a practical example of the data reception table 9100.
- the data reception table 9100 has a message number field 9101 for identifying a transmission source and a transmission event.
- the message number field 9101 may be an actual field, or it may be given as a particular address assigned to the relevant message instead of the actual field.
- Other fields of the data reception table 9100 include a validity field 9102 indicating validity of the relevant message, a time-of-day field 9103 recording the time of day at which the relevant message has been transmitted, a message data field 9104, and a failure vote field 9105.
- the message outputted from each node contains those items of information and is stored in the data reception table divided into predetermined fields in the node that has received the message.
- the validity field corresponding to such a message may be set invalid (0) from the beginning.
- the validity field corresponding to such a message may be set valid just for the purpose of signal monitoring.
- the failure detection notification 230 is received from any node, it is reflected on the data field to be able to make determination on whether the received detection notification is valid.
- a method of diagnosing a failure of the other node will be described with reference to Fig. 61. While the following description is made of the case where the operation amount generating node is failed, it is similarly applied to the case where any other node is failed.
- the message number field 9101 corresponding to the operation amount generating node is taken out (step S2110).
- this step is executed by accessing the relevant address.
- the validity field 9102 of the data reception table 9100 is referred to. If the validity field 9102 indicates the data being valid and the time-of-day field 9103 is updated, control is executed using the data in the message data field 9104 sent from the operation amount generating node.
- whether the time-of-day field 9103 is updated or not is determined, for example, by checking whether the difference between the time-of-day information ("now") owned by the relevant node and the time-of-day field ("time") 9103 corresponding to each message is within a preset certain value (“limit”)(step S2120).
- the time of day contained in the message corresponding to the node 5 is older than the other nodes and has a difference not less than 50. Based on such a difference, it is determined that the operation amount generating node is not operated. If the relevant field is determined as being not valid with the above-mentioned method or another suitable one, this means that the operation amount generating node does not operate normally. Therefore, control is executed using the information sent from the other nodes (step S2140). On the other hand, if the relevant field is determined as being valid with the above-mentioned method or another suitable one, control is executed using the information sent from the operation amount generating node (step S2130).
- a failure vote is outputted to notify the determination result to the other nodes (step S2150).
- This failure vote is stored in the failure vote field 9105.
- a predetermined algorithm e.g., majority decision
- the recovery can be realized, for example, with elimination of a trouble or automatic resetting. In such a case, too, whether the relevant node has recovered or not is decided with voting made from the other nodes based on the observation results.
- the voting algorithm used in determining the recovery of the failed node may be selected as a different one from the algorithm used in determining the occurrence of a failure. For example, the recovery may be determined based on unanimous voting of all the nodes. Further, even the actuator node is also constituted to output a vote so that the system state can be shared by all the nodes via failure voting.
- the ninth embodiment is not limited to the above-described example, and it can be practiced in various forms.
- the command controller for generating control commands is not always required to be a single integrated one, and it may be constituted by a plurality of command controllers.
- a system may comprise a sensor controller 3000-1 for taking in information from a steering wheel angle sensor 3002-2 and outputting steering wheel angle information D3000 to a network, a sensor controller 3001-1 for taking in information from a brake pedal position sensor 3001-2 and outputting brake pedal step-down amount information D3001 to the network, an actuator controller 3002-1 for operating a steering angle control motor 3002-2, an actuator controller 3003-1 for operating an electric brake caliper, a command controller A (3010-1), and a command controller B (3010-2), which are interconnected via an in-vehicle network N3000.
- the command controller 3010-2 for computing a target braking force D3010-2 and the command controller 3010-1 for computing a target steering angle D3010-1 are arranged in physically spaced relation, whereby a probability of total loss of the integrated control function can be reduced.
Landscapes
- Engineering & Computer Science (AREA)
- Transportation (AREA)
- Mechanical Engineering (AREA)
- Combustion & Propulsion (AREA)
- Chemical & Material Sciences (AREA)
- Automation & Control Theory (AREA)
- Power Engineering (AREA)
- Life Sciences & Earth Sciences (AREA)
- Sustainable Development (AREA)
- Sustainable Energy (AREA)
- Human Computer Interaction (AREA)
- Mathematical Physics (AREA)
- Physics & Mathematics (AREA)
- Control Of Driving Devices And Active Controlling Of Vehicle (AREA)
- Regulating Braking Force (AREA)
- Steering Control In Accordance With Driving Conditions (AREA)
- Control Of Vehicle Engines Or Engines For Specific Uses (AREA)
- Safety Devices In Control Systems (AREA)
Abstract
Description
- The present invention relates to a vehicle control system for controlling the running state of a vehicle. More particularly, the present invention relates to a vehicle control system for electronically controlling driving of a prime mover, steering and braking in a vehicle such as an automobile.
- As a vehicle control system, there was hitherto known an operation control system for controlling various control means related to a braking force, a driving force and a steering angle by an electronic control system, i.e., one master, in a concentrated manner (see, e.g., Patent Reference 1: JP-A-2003-263235).
- Recently, aiming at an improvement of comfortableness in driving and safety of an automobile, a vehicle control system has intensively been developed in which driver's operations on an accelerator, a steering wheel and a brake are reflected on mechanisms for generating vehicle driving, steering and braking forces under electronic control without resorting to mechanical linkages. In such a vehicle control system, high reliability is required to ensure that the functions of driving, steering and braking the vehicle are in no way failed.
- In other words, control realized with a mechanical mechanism has been replaced by control realized with an electrical mechanism. Typical examples are the so-called "Fly-by-Wire" in airplane control and "X-by-Wire" in automotive control. In these applications, a mechanical backup mechanism was initially provided to be ready for the event of a failure. However, the electrical mechanism has been required to have high reliability with a tendency to omit the mechanical backup mechanism.
- Of the "X-by-Wire" (XBW system) for electrical control of an automobile, the "Steer-by-Wire" for electrical control of steering and the "Brake-by-Wire" for electrical control of braking are required to positively operate without malfunctions and to have high reliability. In particular, the "Steer-by-Wire" is required to have extremely high reliability because of the absence of a (failsafe) steering position that ensures safety in the event of a failure.
- On the other hand, the merit of the "X-by-Wire" resides in that vehicle safety is improved by electronically controlling the steering and braking operations in an integrated manner. This point is represented by the widely-spreading concept "active safety", i.e., the concept of enhancing safety of an automobile with the so-called vehicle stabilization control (see, e.g., Patent Reference 3: JP-A-10-291489).
- In one known example of the vehicle control system aiming at high reliability, the reliability is improved by providing a dual-redundant master controller that has the functions of ABS (Antilock Brake System), TCS (Transmission Controlled System), etc. (see, e.g., Non-Patent Reference 1: Literature of First "X-by-Wire" Seminar, by D&M Nikkei Mechanical, etc., pp. 3-6, lower left picture in slide 12). Another example is intended to realize high reliability by designing a control module for a front wheel brake to continue the normal operation even when an error occurs (so-called "fail-operative"), and designing a control module for a rear wheel brake to stop the function when an error occurs (so-called "fail-silent") (see, e.g., Patent Reference 2: JP-A-2002-347602).
- As another type of vehicle control system, there is also known, for example, a system in which an operation amount applied from a driver to a maneuvering means, such as a brake pedal, is converted to an electric signal and the electric signal is transmitted to a control computer provided in a brake mechanism via a communication means, such as a CAN (Controlled Area Network), thereby performing electronic control.
- The above-mentioned vehicle control system is generally known as the "X-by-Wire" system and is expected to realize more intelligent integrated running control, to reduce the vehicle weight, and to increase the flexibility in design by using a computer in comparison with the known system transmitting control forces through mechanical and hydraulic mechanisms.
- In the known vehicle control system, signals from sensors for monitoring the operation amounts applied from the driver and the vehicle status are inputted to an electronic control unit serving as one master (i.e., a master ECU), and an engine controller, a brake controller and a steering controller, i.e., actuators for vehicle control, are controlled in an integrated manner. Therefore, if the master ECU is failed, the maneuvering of the vehicle cannot be performed at all. For that reason, the master ECU must have extremely high reliability to ensure safety.
- With that situation in mind, providing a plurality of master ECU's with redundancy is proposed to ensure the reliability. However, redundancy of the master ECU requiring sophisticated processing increases the cost.
- In conventional control architecture, an entire vehicle is constructed of subsystems such as an engine, a steering apparatus, and a brake. The reason is that an operating means and an actuator are provided in one-to-one relation as represented by pairs of an accelerator and the engine, a steering wheel and the steering apparatus, and a brake pedal and the brake.
- Many of the XBW systems currently put into practice are designed as extensions of such conventional control architecture. Stated another way, the subsystems are constructed per each of the functions of "Drive-by-Wire", "Steer-by-Wire", "Brake-by-Wire", etc., and vehicle motion control is realized with coordination among the subsystems.
- As a result of studying the problem with the known technique (conventional control architecture), the inventors have confirmed that a very high cost is necessary to ensure high reliability, real-time processing, and expandability required for the vehicle control system. The problem of the known technique is discussed in more detail below.
- An integrated vehicle control system requires high reliability. In other words, even if a controller, a sensor or an actuator is failed, safe running of a vehicle must be ensured.
- In the known technique, the fail-operative function (i.e., operation capability in the event of a failure) is required per subsystem because development of the function is performed per subsystem. Thus, the known technique includes an ECU for controlling an actuator (such as a steering apparatus or a brake) in accordance with a sensor (such as steering wheel or a brake pedal) per subsystem.
- The ECU controls the associated sensor and actuator in a concentrated manner. To provide the fail-operative function in the entire system, therefore, the ECU per subsystem is required to have the fail-operative function. Providing the fail-operative function in the ECU increases the product cost because of the necessity of redundancy, etc.
- Consequently, it is difficult to realize a highly reliable system at a low cost with the known technique that the ECU is installed per subsystem and is given with the fail-operative function.
- In view of the above-mentioned problem, the inventors have found it effective, in realizing a highly reliable and low-cost system, to separate the ECU control functions into an integrated vehicle control function, an actuator control function and a sensor control function, to provide necessary and sufficient reliability per function, and to give the actuator control function with an autonomous backup function that is controllable in accordance with sensor information even when an abnormality occurs in the integrated vehicle control function.
- Also, the vehicle control system is operated on the basis of hard real-time processing that satisfies strict time restrictions. In other words, changes in maneuvering of the driver and conditions of road surfaces must be promptly reflected on the control within a limit time. With the known technique, the real-time processing within the subsystem can relatively easily be ensured because development of the function is performed per subsystem.
- However, the known technique has a difficulty in ensuring the real-time processing in the case of integrated control using a plurality of actuators, such as skidding attitude control. More specifically, because information obtained from one sensor is propagated successively through the vehicle control functions for the plural subsystems such as the brake, the steering apparatus and the engine, it is difficult to ensure the operation within a deadline time required for the relevant control.
- Further, a delay in data propagation makes it also difficult to ensure simultaneity in obtaining data that is referred to by each subsystem. Realizing the sophisticated coordination in the vehicle motion control with the known technique, therefore, increases the number of steps required for adaptation and adjustment of the system and the subsystems, thus resulting in an increase of the development cost.
- Thus, a difficulty exists in realizing the real-time integrated control at a low cost with the known system in which vehicle control logics and device drivers are distributed in respective ECU's and coordination must be made among the ECU's.
- In view of the above-mentioned problem, the inventors have found it effective, in realizing the real-time integrated control, to separate the control functions into an integrated vehicle ECU and device controllers (i.e., actuator and sensor controllers), and to constitute them to be able to autonomously operate while sharing data.
- In development of a new model car, a method of developing a plurality of new models using a common platform is generally employed to cut the development cost. This requires that addition of the function and change of parts can easily be performed per model. With the known technique, however, it is difficult to realize standardization at a sensor/actuator level because the various functions are performed by the respective ECU's at the subsystem level.
- In other words, control logics in each ECU contain two parts in a mixed way, i.e., one corresponding to a logical and abstract control application, and the other corresponding to a device driver for actually controlling the sensor or the actuator.
- Although there is a tendency toward standardization of device drivers, the tendency is limited to standardization in terms of interface alone, and the individual device drivers are closely related to the respective control applications in terms of real-time processing, ECU resources, etc.
- That characteristic raises the problem that, whenever a sensor and/or an actuator is added or changed, control tasks, etc. at the subsystem level must be redesigned and the development cost is increased.
- To realize a highly expandable system, it is required that controllers be designed to enable individual sensors and actuators to autonomously operate, and virtual common memories are provided in decentralized vehicle control units. In this respect, the inventors have found it effective to enable each sensor or actuator to broadcast, e.g., status information or a control target value to the common memories via a high-order interface, and to autonomously acquire required data or make control based on the received data.
- Thus, the problem in realizing practical use of a vehicle control system with high reliability resides in achieving the high reliability without inviting a noticeable cost increase. From the viewpoint of cost, however, the known technique cannot be said as providing an optimum system because a master controller and control modules are partly designed to have the fail-operative function with a complicated redundant hardware configuration, for example.
- Additionally, with the known technique, a vehicle can be avoided from slipping or spinning to prevent an accident by electronically correcting, e.g., the braking operation even when the driver applies a brake beyond a limit set on the vehicle.
- However, because respective brakes associated with four wheels are controlled by an electronic control unit (ECU) in a concentrated manner in accordance with information obtained from a brake pedal and various sensors, the braking operation is no longer effectuated if the ECU is failed. Accordingly, the ECU is required to have high reliability, and a further consideration must be paid to a control system.
- In view of the state of the art set forth above, it is an object of the present invention to provide a vehicle control system which can ensure high reliability, real-time processing, and expandability with a simplified ECU configuration and a low cost by backing up an error through coordination in the entire system without increasing a degree of redundancy of individual controllers beyond the least necessary level.
- To achieve the above object, the present invention may provide a vehicle control system comprising a sensor slave computer (sensor controller) for outputting a sensor value to a network, a master computer (command controller) for receiving the sensor value, computing a control target value based on the sensor value, and outputting the computed control target value to the same network, and/or an actuator slave computer (actuator controller) for receiving the control target value and operating an actuator. When the actuator slave computer cannot properly receive the control target value, the actuator slave computer may receive the sensor value outputted from the sensor slave computer to the same network and may compute a control target value based on the received sensor value, thereby controlling the actuator.
- Also, the present invention may provide a vehicle control system comprising an operation amount generating node for computing an operation amount command value based on driver's demand signals and vehicle status signals from sensors, and/or actuator driving nodes each controlling an actuator in accordance with the operation amount command value from the operation amount generating node, thereby driving, steering and braking a vehicle. Each of those nodes may have a failure detecting function and operate such that, when a failure is detected in itself with the failure detecting function, the relevant node does not make any action externally of the relevant node except for notifying that the relevant node is in a failed state. When a failure occurs in any node, the other normal nodes than the failed node may switch over control in accordance with a failure detecting notification from the failed node, thereby continuing normal operation as an entire system.
- Each of the driver's demand detecting sensors may be connected to a communication network, and when a failure of the relevant sensor is detected, the relevant sensor does not make any action externally of the relevant sensor except for notifying that the relevant sensor is in a failed state.
- More specifically, each of the sensors may comprise a plurality of sensor elements, A/D converters for converting outputs of the plurality of sensor elements to digital values, a match checking function for a plurality of A/D-converted values, a filter function, and/or a communication interface.
- When the operation amount generating node receives the failure detection notification from the failed node, the operation amount generating node may switch over control depending on a failure position so that a vehicle running state is kept stable.
- Each of the actuator driving nodes may have a function of generating an operation amount command value based on the signals from the driver's demand detecting sensors when the operation amount command value is not receivable from the operation amount generating node. The operation amount generating node may switch over control from a normal mode to a mode for realizing the operation amount command value generating function so that the vehicle running state is kept stable, when the operation amount command value is not receivable from the operation amount generating node.
- The driver's demand detecting sensors, the operation amount generating node, and/or the actuator driving node may be connected to the same communication network. The communication network may comprise a main bus and a backup bus. The main bus may be connected to all of the driver's demand detecting sensors, the operation amount generating node and/or the actuator driving nodes. The backup bus may be connected to a part of the driver's demand detecting sensors and/or a part of the actuator driving nodes. In the event of a failure of the main bus, the actuator driving nodes operate such that a vehicle running state is kept stable.
- In the vehicle control system according to the present invention, more specifically, the driver's demand detecting sensors may include a steering angle sensor for measuring a steering wheel rotational angle, a brake pedal position sensor for measuring a brake pedal step-down amount, and/or an accelerator pedal position sensor for measuring an accelerator pedal step-down amount. The operation amount generating node may be constituted as a vehicle motion integrated controller and a driving-system integrated controller. The vehicle motion integrated controller may interpret a driver's intent based on the signals from the driver's demand detecting sensors and control a vehicle motion in an integrated manner in combination with the signals from the vehicle status detecting sensors. The driving-system integrated controller may interpret a driver's intent based on the signals from the driver's demand detecting sensors and control a driving system of the vehicle in an integrated manner in combination with the signals from the vehicle status detecting sensors. The actuator driving nodes may be constituted as a steering actuator driving controller for controlling a steering actuator which generates a steering force, a brake actuator driving controller for controlling a brake actuator which generates a braking force, and/or a suspension actuator driving controller for controlling a suspension actuator which adjusts a damping force. Those nodes may be connected to the same communication network. A radar or a camera for detecting a situation outside the vehicle may be connected to the communication network.
- In addition, the accelerator pedal position sensor may be connected to the communication network and may be further directly connected to an engine controller for receiving a torque command value from the driving-system integrated controller and controlling an engine in accordance with the received torque command value.
- In the vehicle control system described above, when a brake pedal and a braking force generating mechanism are not coupled mechanically to each other, at least the brake pedal position sensor may be constituted to enable normal operation to be continued even in the occurrence of a single failure.
- When a steering wheel and a steering force generating mechanism are not coupled mechanically to each other, at least the steering angle sensor and the steering actuator driving controller may be constituted to enable normal operation to be continued even in the occurrence of a single failure, and the steering actuator may be installed plural with redundancy.
- A force generated by each of the plurality of steering actuators may be smaller than a force generated by the steering actuator when the steering wheel and the steering force generating mechanism are mechanically coupled to each other.
- Also, the steering actuator driving controller may comprise a plurality of driving nodes with redundancy each constituted such that, when a failure in the relevant node is detected, the relevant node does not make any action externally of the relevant node except for notifying that the relevant node is in a failed state. The driving nodes may drive the steering actuators in redundant arrangement independently of one another.
- In the vehicle control system including no backup mechanisms for braking and steering, each of the brake pedal position sensor and the steering angle sensor may be constituted as a set of fail-silent sensors with redundancy each comprising a plurality of sensor elements, A/D converters for converting outputs of the plurality of sensor elements to digital values, a match checking function for a plurality of A/D-converted values, a filter function, and/or a communication interface. As an alternative, each of the brake pedal position sensor and the steering angle sensor may be constituted as a fail-operative node comprising at least three sensor elements, A/D converters for converting outputs of the plurality of sensor elements to digital values, a majority decision function for a plurality of A/D-converted values, a filter function, and/or a communication interface.
- Further, the present invention may provide a vehicle control system comprising an operation amount generating node, a correction amount generating node, and/or an actuator driving node. The actuator driving node may control the actuator by using, as a control target value, a value obtained by adding the correction amount from the correction amount generating node to the operation amount from the correction amount generating node when the correction amount generating node is normal, and may control the actuator by using, as the control target value, the operation amount from the operation amount generating node when the correction amount generating node is abnormal.
- As a result, even if the correction amount generating node is failed, the actuator can be controlled in accordance with the operation amount from the operation amount generating node although the correction is not performed.
- Still further, the present invention may provide a vehicle control system comprising a plurality of actuator driving units for controlling actuators in accordance with a driver's demand and a vehicle status, and/or a communication unit for interconnecting the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. Each of the actuator driving units may have a control method selecting unit for selecting an actuator control method based on an operation state of itself and operation states of the other actuator driving units.
- Still further, the present invention may provide a vehicle control system comprising a plurality of actuator driving units for controlling actuators in accordance with a driver's demand and a vehicle status, and/or a communication unit for interconnecting the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. Each of the actuator driving units may have a failure detecting unit for detecting its own failure and notifying the occurrence of the failure to the other actuator driving units via the communication unit, and may have a control method selecting unit for selecting an actuator control method based on the failed state of itself and the failed states of the other actuator driving units.
- Still further, the present invention may provide a vehicle control system comprising a plurality of actuator driving units for controlling actuators in accordance with a driver's demand and a vehicle status, and/or a communication unit for interconnecting the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. Each of the actuator driving units may have a control method selecting unit for selecting an actuator control method based on reception states of messages sent from the other actuator driving units via the communication unit.
- Still further, the present invention may provide a vehicle control system comprising a plurality of actuator driving units for controlling actuators in accordance with a driver's demand and a vehicle status, and/or a communication unit for interconnecting the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. Each of the actuator driving units may send a message notifying its own operation state to the other actuator driving units via the communication unit, and may have a control method selecting unit for selecting an actuator control method based on whether the messages have been received from the other actuator driving units.
- Still further, the present invention may provide a vehicle control system comprising at least one operation amount generating unit for computing operation amount command values based on a driver's demand and a vehicle status, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit, and/or a communication unit for interconnecting the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. Each of the actuator driving units may have a control method selecting unit for selecting an actuator control method based on an operation state of itself, operation states of the other actuator driving units, and an operation state of the operation amount generating unit.
- Still further, the present invention may provide a vehicle control system comprising at least one operation amount generating unit for computing operation amount command values based on a driver's demand and a vehicle status, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit, and/or a communication unit for interconnecting the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. The operation amount generating unit may have a failure detecting unit for detecting its own failure and notifying the occurrence of the failure to the actuator driving units or the operation amount generating unit via the communication unit. Each of the actuator driving units may have a failure detecting unit for detecting its own failure and notifying the occurrence of the failure to the other actuator driving units or the operation amount generating unit via the communication unit, and may have a control method selecting unit for selecting an actuator control method based on the failed state of itself, the failed states of the other actuator driving units, and the failed state of the operation amount generating unit.
- Still further, the present invention may provide a vehicle control system comprising at least one operation amount generating unit for computing operation amount command values based on a driver's demand and a vehicle status, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit, and/or a communication unit for interconnecting the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. Each of the actuator driving units may have a control method selecting unit for selecting an actuator control method based on reception states of messages sent from the other actuator driving units or the operation amount generating unit.
- Still further, the present invention may provide a vehicle control system comprising at least one operation amount generating unit for computing operation amount command values based on a driver's demand and a vehicle status, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit, and/or a communication unit for interconnecting the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. The operation amount generating unit may send the operation amount command values to the actuator driving units via the communication unit. Each of the actuator driving units may send, upon receiving the operation amount command value, a response message to the operation amount generating unit or the other actuator driving units via the communication unit, and may have a control method selecting unit for selecting an actuator control method based on whether the operation amount command value from the operation amount generating unit or the response messages from the other actuator driving units have been received.
- Still further, the present invention may provide a vehicle control system comprising sensor units for detecting a driver's demand and a vehicle status, at least one operation amount generating unit for computing operation amount command values based on information from the sensor units, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit or the information from the sensor units, and/or a communication unit for interconnecting the sensor units, the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. Each of the actuator driving units may have a control method selecting unit for selecting one of a control method using the operation amount command value from the operation amount generating unit, a control method using the information from the sensor units, and a control method of bringing the actuator into a predetermined state based on an operation state of itself, operation states of the other actuator driving units, and an operation state of the operation amount generating unit.
- Still further, the present invention may provide a vehicle control system comprising sensor units for detecting a driver's demand and a vehicle status, at least one operation amount generating unit for computing operation amount command values based on information from the sensor units, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit or the information from the sensor units, and/or a communication unit for interconnecting the sensor units, the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. The operation amount generating unit may have a failure detecting unit for detecting its own failure and notifying the occurrence of the failure to the actuator driving units or the operation amount generating unit via the communication unit. Each of the actuator driving units may have a failure detecting unit for detecting its own failure and notifying the occurrence of the failure to the other actuator driving units or the operation amount generating unit via the communication unit, and may have a control method selecting unit for selecting one of a control method using the operation amount command value from the operation amount generating unit, a control method using the information from the sensor units, and a control method of bringing the actuator into a predetermined state based on the failed state of itself, the failed states of the other actuator driving units, and the failed state of the operation amount generating unit.
- Still further, the present invention may provide a vehicle control system comprising sensor units for detecting a driver's demand and a vehicle status, at least one operation amount generating unit for computing operation amount command values based on information from the sensor units, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit or the information from the sensor units, and/or a communication unit for interconnecting the sensor means, the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. Each of the actuator driving units may have a control method selecting unit for selecting one of a control method using the operation amount command value from the operation amount generating unit, a control method using the information from the sensor units, and a control method of bringing the actuator into a predetermined state based on reception states of messages sent from the other actuator driving units or the operation amount generating unit.
- Still further, the present invention may provide a vehicle control system comprising sensor units for detecting a driver's demand and a vehicle status, at least one operation amount generating unit for computing operation amount command values based on information from the sensor units, a plurality of actuator driving units for controlling actuators in accordance with the operation amount command values from the operation amount generating unit or the information from the sensor units, and/or a communication unit for interconnecting the sensor means, the operation amount generating unit and the plurality of actuator driving units, thereby controlling at least one of driving, steering and braking of a vehicle. The operation amount generating unit may send the operation amount command values to the actuator driving units via the communication unit. Each of the actuator driving units may send, upon receiving the operation amount command value, a response message to the operation amount generating unit or the other actuator driving units via the communication unit, and may have a control method selecting unit for selecting one of a control method using the operation amount command value from the operation amount generating unit, a control method using the information from the sensor units, and a control method of bringing the actuator into a predetermined state based on whether the operation amount command value from the operation amount generating unit or the response messages from the other actuator driving units have been received.
- Still further, the present invention may provide a vehicle control system for driving, steering and braking a vehicle, the vehicle control system comprising a node for detecting a driver's demand and outputting a corresponding signal; an operation amount generating node for computing an operation amount command value based on the driver's demand signal and outputting a corresponding signal; and/or an actuator driving node for controlling an actuator in accordance with the operation amount command value from the operation amount generating node. Those three nodes may be arranged in a decentralized manner. Each of those three nodes may include a data reception table storing the signals outputted from the other nodes and has a function of detecting a failure of the other nodes by determining data stored in the data reception table.
- Still further, the present invention may provide a vehicle control system, wherein the data reception table includes information representing the time of each message. Each node may have a function of determining that a message transmission source or a communication path does not operate normally or has recovered to a normal state, when a time delay is larger than a predetermined value.
- Still further, the present invention may provide a vehicle control system wherein the data reception table includes a failure vote section. Each node may have a function of identifying a failed node or a node having recovered to a normal state in accordance with a predetermined algorithm. With this feature, the occurrence of a failure in any node and recovery of the failed node to a normal state can be determined, whereby vehicle control can safely be continued.
- Still further, the present invention may provide a vehicle control system, wherein each node outputs, as failure votes, failure diagnosis information of the other nodes so that failure determination results of the individual nodes are shared by all the nodes. With this feature, the failure determination results of the individual nodes are made coincident with one another, whereby vehicle control can safely be continued.
- According to the vehicle control system of the present invention, even if the operation amount generating unit or any of the actuator driving units becomes uncontrollable, the vehicle control can safely be continued using the other actuator driving units. It is therefore possible to ensure high reliability, real-time processing, and expandability with a simplified ECU configuration and a low cost without increasing a degree of redundancy of individual controllers beyond the least necessary level.
-
- Fig. 1 is a block diagram showing a basic configuration of a vehicle control system according to a first embodiment of the present invention;
- Figs. 2A and 2B are each a data flowchart showing a practical example of communication data flows in the vehicle control system according to the first embodiment;
- Fig. 3 is a schematic view of a vehicle to which the vehicle control system according to the first embodiment is applied;
- Fig. 4 is a control block diagram of a vehicle motion integrated control ECU in the vehicle control system according to the first embodiment;
- Fig. 5 is an illustration for explaining vehicle motion status variables;
- Fig. 6 is a flowchart showing a vehicle status estimation flow executed by a vehicle status estimating section of the vehicle motion integrated control ECU;
- Fig. 7 is a flowchart showing a target status computation flow executed by a target status computing section of the vehicle motion integrated control ECU;
- Fig. 8 is an illustration for explaining a body operation vector and moment;
- Fig. 9 is a flowchart showing an operation amount computation flow executed by an operation amount computing section of the vehicle motion integrated control ECU;
- Fig. 10 is an illustration for explaining tire vectors in body operation;
- Figs. 11A and 11B are each a representation for explaining an operation amount allocation process;
- Fig. 12 is a control block diagram of a DBW-system integrated control ECU in the vehicle control system according to the first embodiment;
- Fig. 13 is a block diagram of an autonomous decentralized control platform (second embodiment) oriented for an integrated vehicle control system in a next-generation vehicle to which the vehicle control system according to the present invention is applied;
- Figs. 14A and 14B are each a block diagram showing an outline of a data field in the autonomous decentralized control platform;
- Fig. 15 is a block diagram showing an outline of autonomous operation of the decentralized control platform;
- Fig. 16 is a block diagram showing an outline of autonomous monitoring;
- Fig. 17 is a flowchart showing an operation flow in an actuator node;
- Figs. 18A and 18B are each a block diagram showing a configuration example of the XBW vehicle control system;
- Fig. 19 is a block diagram showing a basic configuration of a vehicle control system according to a second embodiment of the present invention;
- Fig. 20 is a block diagram showing the function of an operation amount generating node;
- Fig. 21 is a block diagram showing the function of an actuator driving node;
- Fig. 22 is a schematic view of a vehicle to which a vehicle control system according to a third embodiment of the present invention is applied;
- Fig. 23 is a diagram for explaining a node failure detecting method in TDMA communication;
- Fig. 24 is a functional block diagram of a fail-silent sensor node;
- Fig. 25 is a block diagram showing a hardware configuration of the fail-silent sensor node;
- Fig. 26 is a schematic view of a vehicle to which a vehicle control system according to a fourth embodiment of the present invention is applied;
- Fig. 27 is a schematic view of a vehicle to which a vehicle control system according to a fifth embodiment of the present invention is applied;
- Fig. 28 is a schematic view of a vehicle to which a vehicle control system according to a sixth embodiment of the present invention is applied;
- Fig. 29 is a schematic view of a vehicle to which a vehicle control system according to a seventh embodiment of the present invention is applied;
- Fig. 30 is a block diagram showing the configuration of the actuator driving node;
- Fig. 31 is a block diagram showing an example in which the operation amount generating node and a correction amount generating node are provided plural with redundancy;
- Fig. 32 is a block diagram showing an example of the actuator driving node having the majority decision function and the comparison function;
- Fig. 33 is a block diagram showing an example of the actuator driving node that performs a gradually changing operation in the event of a failure;
- Fig. 34 is a time chart showing the gradually changing operation in the event of a failure;
- Fig. 35 is a block diagram showing an example in which the nodes are connected to the same communication path;
- Fig. 36 is a representation showing a flow of information transmitted via the same communication path;
- Fig. 37 is a block diagram showing a practical example in which the seventh embodiment is applied to a "Steer-by-Wire" system;
- Fig. 38 is a block diagram showing a practical example in which the seventh embodiment is applied to a "Brake-by-Wire" system;
- Fig. 39 is a block diagram showing a practical example in which the seventh embodiment is applied to a "Steer-by-Wire" and "Brake-by-Wire" integrated system;
- Fig. 40 is a block diagram showing a basic configuration of a vehicle control system according to an eighth embodiment of the present invention;
- Fig. 41 is a block diagram showing one modification of the vehicle control system according to the eighth embodiment of the present invention;
- Fig. 42 is a block diagram showing another modification of the vehicle control system according to the eighth embodiment of the present invention;
- Fig. 43 is a block diagram showing the function of the operation amount generating node;
- Fig. 44 is a block diagram showing the function of the actuator driving node;
- Fig. 45 is a time chart showing the operation of the actuator driving node;
- Fig. 46 is a flowchart showing a control program selection process;
- Figs. 47A and 47B are each a representation showing an example of a control program selection table;
- Fig. 48 is a time chart showing the operations of the operation amount generating node and the actuator driving node at the start timing of brake control;
- Fig. 49 is a time chart showing the operations of the operation amount generating node and the actuator driving node during the brake control;
- Fig. 50 is a flowchart showing a process for selecting wheels on which the brake control is to be executed;
- Figs. 51A and 51B are each a representation showing an example of a braked wheel selection table;
- Fig. 52 is a time chart showing the operations of the operation amount generating node and the actuator driving node when the actuator driving node or an actuator for a rear left wheel is failed at the start timing of the brake control;
- Fig. 53 is a time chart showing the operations of the operation amount generating node and the actuator driving node when the actuator driving node or the actuator for the rear left wheel is failed during the brake control;
- Fig. 54 is a time chart showing the operations of the operation amount generating node and the actuator driving node when the actuator driving node or an actuator for the rear left wheel, which has been temporarily failed, is recovered to the normal state during the brake control;
- Fig. 55 is a time chart showing the operation of the actuator driving node when the operation amount generating node is failed during the brake control;
- Fig. 56 is a time chart showing the operation of the operation amount generating node and the actuator driving node when the operation amount generating node, which has been temporarily failed, is recovered to the normal state during the brake control;
- Fig. 57 is a time chart showing the operation of the actuator driving node when the operation amount generating node and the actuator driving node or the actuator for the rear left wheel are failed during the brake control;
- Fig. 58 is a block diagram showing still another modification of the vehicle control system according to the eighth embodiment of the present invention;
- Fig. 59 is a block diagram showing a vehicle control system according to a ninth embodiment of the present invention;
- Fig. 60 is a representation showing a practical example of a data reception table;
- Fig. 61 is a flowchart showing failure diagnosis process for another node; and
- Fig. 62 is a block diagram showing a vehicle control system according to still another embodiment of the present invention.
- First, a basic configuration of a vehicle control system according to a first embodiment of the present invention will be described below with reference to Fig. 1.
- The vehicle control system comprises a master computer (command controller) 1, a sensor slave computer (sensor controller) 2, and an actuator slave computer (actuator controller) 3. These computers are interconnected to perform two-way data communication among them via a wired or wireless network N1 of bus, mesh, star, ring or any other suitable type.
- The
master computer 1 is a command controller for computing a control target value and includes a master control function (master control means) 1A. - The
sensor slave computer 2 is connected to asensor 4 for monitoring (measuring) the status of a control target. Thesensor slave computer 2 includes a sensor processing function (sensor processing means) 2A for processing a sensor signal from thesensor 4. - An
actuator 5 for operating the control target is connected to theactuator slave computer 3. Theactuator slave computer 3 is a slave computer for controlling theactuator 5, and it includes an actuator control function (actuator control means) 3A for controlling theactuator 5 in accordance with the control target value from themaster computer 1 and a simplified master function (control target value generating means) 3B for computing the control target value. - On the network N1, there are a data flow D1 of the control target value and a data flow D2 of a measured sensor value.
- The measured-sensor-value data flow D2 is a data flow of the measured sensor value outputted from the
sensor slave computer 2. The measured sensor value outputted from thesensor slave computer 2 is received by both the master function 1A of themaster computer 1 and thesimplified master function 3B of theactuator slave computer 3. - The control-target-value data flow D1 is a data flow of the control target value outputted from the
master computer 1. The control target value outputted from themaster computer 1 is received by the actuator control function 3A of theactuator slave computer 3. - In the normal operation, the
actuator slave computer 3 controls theactuator 5 in accordance with the control target value received by the actuator control function 3A from themaster computer 1 via the data flow D1. - In the event of abnormality in the data flow D1, however, the
actuator slave computer 3 controls theactuator 5 in accordance with the control target value computed by the simplifiedmaster function 3B. More specifically, thesimplified master function 3B computes the control target value based on the measured sensor value obtained via the data flow D2, and the actuator control function 3A controls theactuator 5 in accordance with the result computed by the simplifiedmaster function 3B, i.e., the control target value, which is obtained via a data flow D3B inside theactuator slave computer 3. - With the configuration described above, even if the master function 1A of the
master computer 1 comes into an inoperable state, the actuator control can be continued in accordance with result computed by the simplifiedmaster function 3B. It is therefore possible to reflect the operation applied from the driver and changes of the vehicle status on the control, and to realize a vehicle control system with high reliability. - While Fig. 1 shows the
master computer 1 as one computer, the master control function may be divided into a plurality of functions, and a plurality of computers may be used to execute the divided functions. - Practical examples of communication data flows in the vehicle control system shown in Fig. 1 will be described below with reference to Figs. 2A and 2B.
- The master computer is embodied as a vehicle motion integrated
control unit 10 for controlling the motion of an entire vehicle in an integrated manner. - The sensor slave computer is embodied as including a steering angle instruction unit (steering angle sensor system) 31, a deceleration instruction unit (brake pedal step-down amount sensor system) 32, and an acceleration instruction unit (accelerator pedal step-down amount sensor system) 33, these instruction units being responsive to operations applied from the driver.
- The actuator slave computer is embodied as including a steering
amount control unit 11 for controlling a vehicle steering angle, a brakingforce control unit 12 for controlling a vehicle braking force, and a drivingforce control unit 13 for controlling a vehicle driving force. - The steering
angle instruction unit 31, thedeceleration instruction unit 32, and theacceleration instruction unit 33, the steeringamount control unit 11, the brakingforce control unit 12, the drivingforce control unit 13, and the vehicle motion integratedcontrol unit 10 are interconnected via the communication bus N11. - Fig. 2A shows the data flow when the vehicle motion integrated
control unit 10 operates normally. - In the data flow of Fig. 2A, numeral D31 denotes an operation amount applied to the steering
angle instruction unit 31 from the driver, which is converted to an electric signal by the steeringangle instruction unit 31 and outputted to the communication bus N11. - Numeral D32 denotes an operation amount applied to the
deceleration instruction unit 32 from the driver, which is converted to an electric signal by thedeceleration instruction unit 32 and outputted to the communication bus N11. - Numeral D33 denotes an operation amount applied to the
acceleration instruction unit 33 from the driver, which is converted to an electric signal by theacceleration instruction unit 33 and outputted to the communication bus N11. - The vehicle motion integrated
control unit 10 receives the steering angle instruction unit operation amount D31, the deceleration instruction unit operation amount D32 and the acceleration instruction unit operation amount D33 via the communication bus N11, and executes computations for controlling the vehicle motion in an integrated manner. - Thereafter, the vehicle motion integrated
control unit 10 outputs a steering amount target value D11, a braking force target value D12, and a driving force target value D13, as target values applied to the respective control units for controlling the vehicle, to the communication bus N11. - The steering
amount control unit 11 receives the steering amount target value D11 via the communication bus N11 and controls a steering system, e.g., a steering mechanism, so that the steering amount target value D11 is realized. - The braking
force control unit 12 receives the braking force target value D12 via the communication bus N11 and controls a braking device, e.g., an electric brake, so that the braking force target value D12 is realized. - The driving
force control unit 13 receives the driving force target value D13 via the communication bus N11 and controls a driving force generator and a power transmission system, e.g., an engine, a transmission and an electric motor, so that the driving force target value D13 is realized. - Fig. 2B shows the data flow when there occurs an error in the vehicle motion integrated
control unit 10. - When the vehicle motion integrated
control unit 10 is failed, the steering amount target value D11, the braking force target value D12 and the driving force target value D13 are not outputted to the communication bus N11. In spite of such a situation, the vehicle must be controlled as intended by the driver. - To that end, when it is determined that an error has occurred in the vehicle motion integrated
control unit 10, the steeringamount control unit 11 receives the steering angle instruction unit operation amount D31 via the communication bus N11 and controls the steering system, e.g., a steering gear, in accordance with the steering angle instruction unit operation amount D31. - When it is determined that an error has occurred in the vehicle motion integrated
control unit 10, the brakingforce control unit 12 receives the deceleration instruction unit operation amount D32 via the communication bus N11 and controls the braking device, e.g., an electric brake, in accordance with the deceleration instruction unit operation amount D32. - When it is determined that an error has occurred in the vehicle motion integrated
control unit 10, the drivingforce control unit 13 receives the acceleration instruction unit operation amount D33 via the communication bus N11 and controls the driving force generator, e.g., the engine, the transmission and the electric motor, in accordance with the acceleration instruction unit operation amount D33. - The fact that an error has occurred in the vehicle motion integrated
control unit 10 is determined by monitoring, e.g., such an event that no data has been outputted to the communication bus N11 for a certain time.
As an alternative, the vehicle motion integratedcontrol unit 10 may output a message indicating the occurrence of an error when the error has occurred. - One example of the vehicle (automobile) to which the vehicle control system according to the present invention is applied will be described below with reference to Fig. 3.
- A control system network N1A corresponds to a communication line in the present invention and is used for communicating data in relation to the vehicle motion control. A control system backup network N1B also corresponds to a communication line in the present invention and serves as a backup means used when the control system network N1A is inevitably failed due to, e.g., wire disconnection in the event of a collision accident.
- A
steering sensor 41 corresponds to the steeringangle instruction unit 31. Thesteering sensor 41 measures the operation amount (steering angle) by which asteering wheel 51 is operated by the driver, and outputs the steering wheel operation amount, as an electric signal, to the control system network N1A and the control system backup network N1B after signal processing such as filtering. - In addition, the
steering wheel 51 is connected to a frontwheel steering mechanism 71 through a mechanical mechanism so that respective steering angles offront wheels vehicle 50 can be controlled even when a trouble has occurred in the control system network N1A, thesteering sensor 41, and an SBW/VGR (Steer-By-Wire/Variable Gear Ratio) driver ECU (Electronic Control Unit) 81 by an inevitable accident. - A brake
pedal position sensor 42 corresponds to thedeceleration instruction unit 32. The brakepedal position sensor 42 measures the operation amount by which abrake pedal 52 is operated by the driver, and outputs the brake pedal operation amount, as an electric signal, to the control system network N1A and the control system backup network N1B after signal processing such as filtering. - In addition, the
brake pedal 52 is connected to frontwheel brake mechanisms 73 through a hydraulic system so that the braking force applied to thevehicle 50 can be controlled even when a trouble has occurred in the control system network N1A, the brakepedal position sensor 52, BBW (Brake-By-Wire) driver ECU's 83A, 83B, etc. by an inevitable accident. - An accelerator
pedal position sensor 43 corresponds to theacceleration instruction unit 33. The acceleratorpedal position sensor 43 measures the operation amount by which anaccelerator pedal 53 is operated by the driver, and outputs the accelerator pedal operation amount, as an electric signal, to the control system network N1A after signal processing such as filtering. - In addition, the accelerator
pedal position sensor 43 is connected to anengine control ECU 21 via another communication line so that the engine of thevehicle 50 can be controlled even when a trouble has occurred in the control system network N1A and a DBW (Drive-By-Wire)-system integratedcontrol ECU 20 by an inevitable accident. - A millimeter wave (EHF) radar/
camera 44 is used to recognize external conditions of thevehicle 50, for example, by detecting running states of other vehicles in front and rear of thevehicle 50 and recognizing a white line as a boundary of the lane along which that thevehicle 50 is running. The millimeter wave radar/camera 44 recognize the external conditions, computes a relative angle, a relative distance, a relative speed, etc. of the other vehicle running ahead, for example, through signal processing, and outputs the computed data as electric signals to the control system network N1A. - The
steering sensor 41, the brakepedal position sensor 42, the acceleratorpedal position sensor 43, and the millimeter wave radar/camera 44 are correspond to the sensor slave computer. - A vehicle motion integrated
control ECU 30 serves as the master computer and corresponds to the vehicle motion integratedcontrol unit 10. The vehicle motion integratedcontrol ECU 30 receives not only the operation amounts applied from the driver and the running state of the vehicle, which are outputted to the control system network N1A, but also values of measured by the sensors associated with the vehicle motion integratedcontrol ECU 30, and manages the motion of thevehicle 50 in an integrated manner. Then, it outputs the control target values for the driving force control unit, the braking force control unit, the steering amount control unit, a suspension control unit, a safety device control unit, etc. to the control system network N1A. - The vehicle motion integrated
control ECU 30 has the gateway function between a supervisory network N3 and the control system network N1A. - Examples of the actuator slave computer include the SBW/
VGR driver ECU 81, anSBW driver ECU 82, BBW driver ECU's 83A - 83D, EAS (Electric Active Suspension) driver ECU's 84A - 84D, and anairbag ECU 85. - The SBW/
VGR driver ECU 81 corresponds to the steering angle control unit. It controls an electric motor M1 to thereby control the respective steering angles offront wheels wheel steering mechanism 71, and also controls an electric motor M5 to thereby control a known steering-system variable gear ratio (VGR)mechanism 54. - The
SBW driver ECU 82 also corresponds to the steering angle control unit and controls an electric motor M2 to thereby control respective steering angles ofrear wheels wheel steering mechanism 74. - The BBW driver ECU's 83A, 83B, 83C and 83D correspond to the braking force control unit.
- The
BBW driver ECU 83A controls an electric motor M3A to control the hydraulic pressure of a pump P, thereby controlling the braking force applied to the frontright wheel 72R through the frontwheel brake mechanism 73. - The
BBW driver ECU 83B controls an electric motor M3B to control the hydraulic pressure of a pump P, thereby controlling the braking force applied to the frontleft wheel 72L through the frontwheel brake mechanism 73. - The
BBW driver ECU 83C controls an electric motor M3C to control the hydraulic pressure of a pump P, thereby controlling the braking force applied to the rearright wheel 75R through a rearwheel brake mechanism 76. - The
BBW driver ECU 83D controls an electric motor M3D to control the hydraulic pressure of a pump P, thereby controlling the braking force applied to the rearleft wheel 75L through the rearwheel brake mechanism 76. - The EAS driver ECU's 84A, 84B, 84C and 84D correspond to the suspension control unit and control
suspension mechanisms 77, 78 installed in thevehicle 50. - The
EAS driver ECU 84A controls an electric motor M4A to thereby control the suspension length, the spring constant, the attenuation constant, etc. of the front wheel suspension mechanism 77 associated with the frontright wheel 72R. - The
EAS driver ECU 84B controls an electric motor M4B to thereby control the suspension length, the spring constant, the attenuation constant, etc. of the front wheel suspension mechanism 77 associated with the frontleft wheel 72L. - The
EAS driver ECU 84C controls an electric motor M4C to thereby control the suspension length, the spring constant, the attenuation constant, etc. of the rearwheel suspension mechanism 78 associated with the rearright wheel 75R. - The
EAS driver ECU 84D controls an electric motor M4D to thereby control the suspension length, the spring constant, the attenuation constant, etc. of the rearwheel suspension mechanism 78 associated with the rearleft wheel 75L. - Thus, by controlling the EAS driver ECU's 84A - 84D with the vehicle motion integrated
control ECU 30, it is possible, for example, to increase the spring constants of the front wheel suspension mechanisms 77 during the deceleration, thereby preventing thevehicle 50 from inclining forward, to increase the spring constants of the suspension mechanisms on the outer side when the vehicle turns, thereby preventing the vehicle from rolling over, and to reduce the front wheel suspension lengths and increase the rear wheel suspension lengths when the vehicle climbs a slope, thereby lessening an inclination of the vehicle. - The
airbag ECU 85 corresponds to the safety device control unit and controls passenger protective devices such as airbags. - The DBW-system integrated
control ECU 20 corresponds to the driving force control unit. The DBW-system integratedcontrol ECU 20 controls devices used for the driving control of thevehicle 50 in an integrated manner, such as anengine control ECU 21, atransmission control ECU 22, an electricmotor control ECU 23, and abattery control ECU 24 which are connected to a DBW sub-network N2. - With that configuration, the vehicle motion integrated
control ECU 30 is just required to instruct a final driving force to the DBW-system integratedcontrol ECU 20. It is hence possible to instruct target values regardless of the configurations of devices related to the actual driving control, and to realize a simplified control system. - The
engine control ECU 21 is an ECU for controlling the engine (not shown). It receives target values of an engine shaft torque, an engine revolution speed, etc. from the DBW-system integratedcontrol ECU 20, and controls the engine so that the target values are realized. - The
transmission control ECU 22 is an ECU for controlling the transmission (not shown). It receives target values of shift stages, etc. from the DBW-system integratedcontrol ECU 20, and controls the transmission so that the target values are realized. - The electric
motor control ECU 23 is an ECU for controlling a not-shown electric motor for generating the driving force. It receives target values of an output torque, a rotational speed, etc. from the DBW-system integratedcontrol ECU 20, and controls the engine so that the target values are realized. The electricmotor control ECU 23 also operates as a driving force generator in the negative direction through regenerative control of the electric motor. - The
battery control ECU 24 is an ECU for controlling a battery (not shown) and control a charged state, etc. of the battery. - An
information system gateway 35 serves as a gateway for connecting an information system network (such as MOST known in the art), which is used for connection to, e.g., a radio communication means (such as a cellular phone), a GPS and a car navigation unit (not shown), and the supervisory network N3 to each other. - With the information system network and the control system network N1A interconnected via the gateway function, the control system network N1A can logically be separated from the information system network, thus making it possible to comparatively simply make up a configuration that can easily satisfy demands specific to the control system network N1A, such as real-time processing.
- A
body system gateway 36 serves as a gateway for connecting a body system network including door locks, power windows, etc. (not shown) and the supervisory network N3 to each other. With the body system network and the control system network N1A interconnected via the gateway function, the control system network N1A can logically be separated from the body system network, thus making it possible to comparatively simply make up a configuration that can easily satisfy demands specific to the control system network N1A, such as real-time processing. - Processing executed by the vehicle motion integrated
control ECU 30 will be described below with reference to Fig. 4. Fig. 4 shows a data flow when the vehicle motion integratedcontrol ECU 30 operates normally. - The vehicle motion integrated
control ECU 30 comprises a vehiclestatus estimating section 101, a targetstatus computing section 102, a body operation vector/moment computing section 103, an operationamount computing section 104, and avehicle parameter memory 105. Then, theECU 30 receives signals from various sensors S, i.e., thesteering sensor 41, the brakepedal position sensor 42, the acceleratorpedal position sensor 43, the millimeter wave radar/camera 44, and other sensors such as a wheel speed sensor, a body acceleration sensor and an angular acceleration sensor (which are not shown in Fig. 3). - The vehicle
status estimating section 101 estimates the current vehicle status based on the sensor signals. - The target
status computing section 102 computes the target vehicle status to be realized with the control, i.e., the target motion status to be taken by the vehicle, based on the vehicle running state estimated by the vehiclestatus estimating section 101 and the sensor signals. - The body operation vector/
moment computing section 103 computes a force vector parallel to the vehicle running direction and a moment vector in the rotating direction, which are to be generated on a vehicle body with the control, based on the difference between the current vehicle status estimated by the vehiclestatus estimating section 101 and the target status computed by the targetstatus computing section 102. - The operation
amount computing section 104 computes the target operation amounts to be realized with the control actuators, such as the BBW driver ECU's 83A - 83D, the DBW-system integratedcontrol ECU 20, the SBW/VRG driver ECU 81, theSBW driver ECU 82, the EAS driver ECU's 84A - 84D, and theairbag ECU 85, based on the force vector and the moment vector computed by the body operation vector/moment computing section 103. - The
vehicle parameter memory 105 stores vehicle parameters, such as dynamic constants of the vehicle body (e.g., the mass, the rotational inertia, and the center of gravity) and specifications of the control actuators (e.g., the time constant of each actuator, the maximum braking force of the brake, and the maximum steering angle of the steering wheel). These vehicle parameters are referred to when processing is executed in the vehiclestatus estimating section 101, the targetstatus computing section 102, the body operation vector/moment computing section 103, and the operationamount computing section 104. - While an output from the operation
amount computing section 104 to each driver ECU is indicated by a single line in Fig. 4, the single line does not means only one value, and also represents one set of controlled variables. For example, the BBW driver ECU's 83A - 83D may receive the respective controlled variables instructing braking forces independent per wheel. - With the vehicle motion integrated
control ECU 30 comprising the vehiclestatus estimating section 101, the targetstatus computing section 102, the body operation vector/moment computing section 103, and the operationamount computing section 104, an advantage capable of managing and controlling the vehicle motion in an integrated manner can be obtained. - Also, with the separation of the vehicle
status estimating section 101, the following advantage is obtained. For example, when the control actuator configuration of the vehicle is changed, such as when only a power train is changed from the engine type to the hybrid type in vehicles having the same platform, a section for computing dynamic characteristics of the vehicle can be reused and therefore the development efficiency of the control system can be increased. - Further, with the separation of the target
status computing section 102, the following advantage is obtained. Even when the vehicle setting is customized depending on individual drivers or when the limits of target values are modified depending on conditions of the road and other vehicles running around the relevant one, only the targetstatus computing section 102 is required to be modified and therefore the development efficiency of the control system can be increased. - Still further, with the body operation vector/
moment computing section 103 and the operationamount computing section 104 being independent of each other, the operation amounts applied to the vehicle body can be computed independently of the configuration of the control systems incorporated in the vehicle. - For example, when an automobile type is changed from the hybrid type to the in-wheel electric motor type, the body operation vector/
moment computing section 103 is able to compute the force and moment vectors to be generated in a similar manner, and only the operationamount computing section 104 requires to be modified. Therefore, the development efficiency of the control system can be increased. - The current vehicle status computed by the vehicle
status estimating section 101 and the target vehicle status computed by the targetstatus computing section 102 will be described below with reference to Fig. 5. - The current status and target status of the vehicle are each represented by a
status variable 1X in motion of a rigid body on an assumption that the body of thevehicle 50 is a rigid body. The status variable 1X means displacements (x, y, z), rotational angles (θx, θy, θz), speeds (dx/dt, dy/dt, dz/dt), and angular speeds (dθx/dt, dθy/dt, dθz/dt) on a three-dimensional (X-Y-Z) local coordinatesystem 1G fixed to, for example, the center of gravity of the body of thevehicle 50. - Because the components of the
status variable 1X are linked with one another in rigid body mechanics, determination of thestatus variable 1X is effective in performing more precise control and realizing control with more comfortableness to passengers and high safety. - A vehicle status estimation flow executed by the vehicle
status estimating section 101 will be described below with reference to Fig. 6. - First, in step S1011, the vehicle
status estimating section 101 estimates the vehicle motion status on the local coordinatesystem 1G fixed to the vehicle. - Then, in step S1012, it estimates the vehicle motion status on a stationary coordinate system fixed to a particular point, e.g., Nihonbashi (one geographical point in Tokyo).
- Then, in step S1013, it estimates the situation around a point where the vehicle is running.
- Then, in step S1014, it estimates and updates a failed state of the vehicle based on the measured values from the sensors S and the failure self-diagnosis results from the control actuators, such as the BBW driver ECU's 83A - 83D, the DBW-system integrated
control ECU 20, the SBW/VRG driver ECU 81, theSBW driver ECU 82, the EAS driver ECU's 84A - 84D, and theairbag ECU 85. - A target status computation flow executed by the target
status computing section 102 will be described with reference to Fig. 7. - First, in step S1021, the target
status estimating section 102 estimates the vehicle status intended by the driver based on the operation amounts detected by thesteering sensor 41, the brakepedal position sensor 42, and the acceleratorpedal position sensor 43, as well as the current vehicle status. - Then, in step S1022, it computes limits on the vehicle status based on the surrounding situation of the vehicle, the performance of the vehicle control system, failed states of individual devices, legal regulations, etc. For example, when brake devices are partly failed, a maximum speed is limited within the range in which the vehicle can safely be braked by using the remaining normal brake devices.
- Then, in step S1023, it decides the target status variable of the
vehicle 50 in conformity with the driver's intent within the range not exceeding the limits set on the vehicle status. - Fig. 8 shows the operation force and moment vectors computed by the body operation vector/
moment computing section 103. - As shown in Fig. 8, an operation force vector F(Fx, Fy, Fz) and an operation moment vector τ(τx, τy, τz) are computed on the local coordinate
system 1G fixed to the vehicle. This is advantageous in facilitating conversion to the operation amounts for the control devices fixed to the vehicle. - An operation amount computation flow executed by the operation
amount computing section 104 will be described with reference to Fig. 9. - The operation
amount computing section 104 receives the body operation force vector F and moment vector τ both computed by the body operation vector/moment computing section 103 and computes what controlled variables are to be set as the target values for the actual control devices. - First, in step S1041, the operation
amount computing section 104 distributes the body operation force vector F and moment vector τ into tire forces to be generated for each of tires attached to thevehicle 50. Then, it computes the target values of the controlled variable for the actual control devices based on the allocated tire vectors. - By using the braking force, the driving force, and the turning force (lateral force generated on the tire with steering) as the target values in the vehicle control, the motion of the entire vehicle can be controlled in an integrated manner.
- Fig. 10 shows the tire vectors computed in step S1041.
- FFR represents the tire vector to be generated on the front right wheel with the control. FFL represents the tire vector to be generated on the front left wheel with the control. FRR represents the tire vector to be generated on the rear right wheel with the control. FRL represents the tire vector to be generated on the rear left wheel with the control. The tire vectors are defined as components on the local coordinate
system 1G fixed to thevehicle 50. - Defining the tire vectors as components on the local coordinate system is advantageous in facilitating conversion to the operation amounts for tire driving axles and the steering mechanisms, which are fixed to the
vehicle 50. - In step S1042, the operation
amount computing section 104 executes an operation amount allocation process. The operation amount allocation process is executed corresponding to the arrangement of the actuators for actually controlling the vehicle. - Figs. 11A and 11B show details of the operation amount allocation process.
- Fig. 11A shows the operation amount allocation process (step S1042a) when the
vehicle 50 has a power train for driving an internal combustion engine or a hybrid engine (HE). This operation amount allocation process outputs, based on the tire vectors as inputs, steering amounts as the target values for the SBW/VRG driver ECU 81 and theSBW driver ECU 82, braking torques as the target values for the BBW driver ECU's 83A - 83D, and power train damping/driving torques as the target values for the DBW-system integratedcontrol ECU 20. - Fig. 11B shows the operation amount allocation process (step S1042b) when the
vehicle 50 has a power train of the known in-wheel electric motor type. This operation amount allocation process outputs steering amounts as the target values for the SBW/VRG driver ECU 81 and theSBW driver ECU 82, braking torques as the target values for regenerative control of in-wheel electric motors and brake pad control ECU's (not shown), and electric motor driving torques as the target values for in-wheel electric motor control ECU's (not shown) are outputted based on the tire vectors as inputs. - By executing the operation amount allocation process corresponding to the arrangement of the actuators for actually controlling the vehicle, modifications of the actuator arrangement are adaptable with replacement of a unit for executing the operation amount allocation process, and therefore the development efficiency of the vehicle control system can be increased.
- The configuration of the DBW-system integrated
control ECU 20 will be described with reference to Fig. 12. - A front-right wheel driving
torque receiving section 201 receives the driving torque to be generated on the frontright wheel 72R. A front-left wheel drivingtorque receiving section 202 receives the driving torque to be generated on the frontleft wheel 72L. A rear-right wheel drivingtorque receiving section 203 receives the driving torque to be generated on the rearright wheel 75R. A rear-left wheel drivingtorque receiving section 204 receives the driving torque to be generated on the rearleft wheel 75L. - A power train operation
amount computing section 205 computes values used as the target values in respective ECU's for controlling the actual actuators, and instruct the operation amounts for theengine control ECU 21, thetransmission control ECU 22, the electricmotor control ECU 23, and thebattery control ECU 24. - In a known torque-based vehicle control system, a torque to be generated on a drive axle of a driving means is used as a target value for executing control. Therefore, the known control system is not compatible with the DBW-system integrated
control ECU 20 for the in-wheel electric motor type in which the driving force can be controlled for each wheel. - In view of the above, a driving system with a driving means for generating a driving force in a concentrated manner, such as an engine- or hybrid engine-equipped system, is also designed so as to receive, as the control target value, the driving force for each wheel and to redistribute respective target values to the driving actuators in the DBW-system integrated
control ECU 20. As a result, a command value receiving scheme (interface) can be shared by both the DBW-system integrated control ECU for the hybrid system and the DBW-system integrated control ECU for the in-wheel electric motor system. - An autonomous decentralized control platform oriented for an integrated vehicle control system in a next-generation vehicle, to which the vehicle control system according to the present invention is applied, will be described below with reference to Fig. 13.
- The purpose of the autonomous decentralized control platform is to realize high reliability, real-time processing, and expandability in vehicle control at a low cost.
- The term "autonomous decentralized" means one of highly reliable decentralized system models used in the control field. In other words, it represents a system in which computing nuclei called nodes corresponding to cells in an organism are loosely coupled with one another via a field, called a data field, where common data is placed.
- For details of "autonomous decentralized", reference should be made on Kinji Mori, Tsugu Miyamoto, and Koichi Ihara; "Proposal of Autonomous Decentralized Concept", Journal C of the Institute of Electrical Engineers of Japan, Vol. 104, No. 12, pp. 303-310 (1984), and K. Mori: "Autonomous Decentralized Systems; Concept, Data Field Architecture and Future Trends", IEEE International Symposium on Autonomous Decentralized Systems (ISADS), pp. 28-34 (1993-Mar).
- In an autonomous decentralized control system, by using a program enabling each node to autonomously operate independently of other nodes, it is possible to realize a configuration in which a failure in a part of the system does not affect the entire system, and to realize a decentralized system with high reliability and expandability. However, a difficulty is faced in application of the autonomous decentralized concept to an actual system based on the biological model, and a generalized application method has not yet been established up to now. Accordingly, studies must be made on architecture for each application system.
- The autonomous decentralized control platform comprises a data field DF10 providing one feature, i.e., 1) common use of data, and nodes (including a sensor node A20, an actuator node A30, and a controller node A10) capable of providing other three features, i.e., 2) autonomous operation, 3) autonomous management, and 4) autonomous backup. The nodes A10, A20 and A30 contain self-monitors (self-monitoring functions) A13, A23 and A33, respectively.
- The controller node A10 starts up a processing routine A11 under a time condition A12 (at a period of, e.g., 10 ms). The controller node A10 gets sensor data DA20 from the data field DF10, computes a control target value for the actuator node A30, and broadcasts the computed control target value, as controller data DA10, to the data field DF10.
- The data field DF10 is a common memory space virtually formed on the control network. In the normal state, the data field DF10 holds therein the sensor data DA20 outputted from the sensor node A20 and the controller data (control target values) DA10 outputted from the controller node A10.
- The term "autonomous operation" in each node means the function of voluntarily executing processing in accordance with the time condition or its own status without receiving any processing request from the other nodes.
- The term "autonomous management" in each node means the function of monitoring its own operation and status by itself, which are concealed from the other nodes.
- The term "autonomous backup" in each node means the function of incorporating a capability of simplified control and computing necessary data by itself with the simplified control when there is an abnormality in data required for processing to be executed in it, thereby realizing the least necessary processing.
- The following description is made to show that the data field DF10 can realize an improvement of expandability adapted for the vehicle control system, the autonomous operation can realize time-dependently activated operation adapted for the real-time decentralized control, and the autonomous management function and the autonomous backup function can realize status monitoring and trouble resistance of the system to ensure reliability.
- Of the autonomous decentralized control platform, the data field will be described below with reference to Figs. 14A and 14B.
- The data field is intended to improve expandability of the vehicle control system. The purpose of introducing the data field is to standardize interfaces among the nodes and to facilitate replacement and addition of parts.
- In the autonomous decentralized control platform, data exchange between the nodes is performed via a data field DF20 that is a virtual common memory defined on the network. Stated another way, each node recognizes data itself as an object without being conscious of what units are connected to the network.
- Therefore, data defined in the data field DF20 is highly abstractive data that can be standardized at a sensor/actuator level. In sensor measurement, for example, a physical value obtained by multiple measurements and subjected to filtering and floating-point arithmetic is defined in the data field instead of primitive data such as a voltage value. Also, in actuator control, standardized data, e.g., a target braking force applied from a brake, is defined in the data field.
- Looking at an example shown in Fig. 14A, a brake pedal sensor node A200 measures the step-down amount of a brake pedal SA200 and broadcasts the measured result, as a brake pedal status variable (brake step-down amount) DA200, to the data field DF20 after conversion to a standardized physical quantity.
- By referring to the brake pedal status variable DA200, a controller node A100 computes target braking forces (only a front-right wheel target braking force DA100 and a front-left wheel target braking force DA101 being shown) for respective wheels, and then broadcasts the computed target braking forces to the data field DF20.
- By referring to the front-right wheel target braking force DA100 and the front-left wheel target braking force DA101, a front wheel brake actuator node A300 controls a front-left wheel brake actuator AA300 and a rear-left wheel brake actuator AA301.
- In an example shown in Fig. 14B, the vehicle-to-vehicle distance control function is added to the control architecture shown in Fig. 14A, and the brake controller is modified correspondingly.
- A radar SA210 for measuring the distance between the relevant vehicle and a vehicle running ahead and a radar node A210 for controlling the radar SA210 are added, and a measured vehicle-to-vehicle distance DA210 is broadcast to the data field DF20.
- By referring to the brake pedal status variable DA200 and the vehicle-to-vehicle distance DA210, the controller node A100 computes target braking forces (only a front-right wheel target braking force DA100 and a front-left wheel target braking force DA101 being shown) for the respective wheels, and then broadcasts the computed target braking forces to the data field DF20.
- By referring to the front-right wheel target braking force DA100, a front-right wheel brake actuator node A310 controls a front-right wheel brake actuator AA310.
- By referring to the front-left wheel target braking force DA101, a front-left wheel brake actuator node A320 controls a front-left wheel brake actuator AA320.
- Thus, as shown in Figs. 14A and 14B, the radar node A210 can be added as a vehicle-to-vehicle distance measuring node just by adding the data of the "vehicle-to-vehicle distance" in the data field DF20 without affecting the other sensors and actuators.
- Also, although the brake actuator node is modified from the front wheel control type to the each wheel independent type, no effects are imposed on the other nodes and the data field DF20. In other words, by using the data field DF20, the nodes can loosely be coupled with one another and a decentralized system with high expandability can easily be realized.
- Of the autonomous decentralized control platform, the autonomous operation will be described with reference to Fig. 15 (and Fig. 13).
- The intent of the autonomous operation is to realize the operation based on time-dependent activation, which is easy to predict processing in terms of time, for adaptation to the decentralized real-time processing.
- With the autonomous operation in the autonomous decentralized control platform, each node voluntarily starts to execute processing in accordance with a time condition or its own status. In other words, each node is able to start up the processing in accordance with node operating conditions including not only reception of a message, but also the time condition (time-of-day or period) and a status change (interrupt) of itself.
- In a real-time system, it is essential to recognize the status of a system as a control target and to reflect the recognized result on control within a certain time. For that reason, control design is required to be able to design the processing execution time on the end-to-end basis. On the other hand, each node is required to have the function of continuing its own processing without being affected from an abnormality in any other node. To realize such a decentralized real-time system with high reliability, the node operation must be made autonomous.
- The sensor node A20 starts up a processing routine A21 under a time condition A22 (at a period of, e.g., 10 ms).
- The sensor node A20 reads a measured value of the sensor SA20, converts the measured value to a physical quantity through pre-processing such as filtering and floating-point arithmetic, and broadcasts a resulting sensor data DA20 to the data field DF10.
- Also, the actuator node A30 starts up a processing routine A31 under a specific time condition A32 (at a period of 20 ms).
- The actuator node A30 acquires the sensor data DA20 from the data field DF10, computes a control target value for itself A30, and controls an actuator AA30 so that the computed control target value is realized.
- The time conditions A22, A32, i.e., startup conditions, may be each given as a change of its own node status, e.g., an interrupt depending on the engine revolution. Thus, the autonomous operation of each node can be realized by enabling the node to voluntarily start up the processing, to acquire necessary data by itself and to execute computation in itself.
- With the autonomous operation, the node operation is of the type activated depending on time or the type activated upon a change of its own node status. In other words, event-based activation from any other node is no longer required, and design of the worst execution time can very easily be made. Further, since the processing can be continued without being affected by an abnormality in any other node, a highly reliable system can be realized.
- Of the autonomous decentralized control platform, the autonomous management will be described below. The intent of the autonomous management is to ensure high reliability required in the vehicle control. More specifically, the autonomous management enables each of nodes constituting a decentralized system to monitor its own operation and to execute processing (fail-operative/fail-silent) in the event of an abnormality per node. Also, to realize both of high reliability and low cost, the fail-operative function (operation capability in the event of a failure) and the fail-silent function (runaway protection in the event of a failure) are selectively performed as the processing in the event of a failure depending on a target node.
- In the known configuration, an ECU per subsystem executes the sensor measurement, computation of vehicle controlled variables, and actuator control. When trying to realize a highly reliable system, therefore, many ECU's are required to have the fail-operative function, thus resulting in an increase of the cost. Another problem is that, when the mutual monitoring function among ECU's is provided, the coupling among the ECU's becomes too close, thus resulting in a deterioration of the expandability and the development efficiency.
- Fig. 16 shows an outline of the autonomous monitoring.
- In the configuration of Fig. 16, a self-monitor A430 is provided in a node A400 to monitor the operation in the normal state (normal function) A410. Then, if there occurs an abnormality, a function stopping process (fail-silent function) A411 is executed.
- Those nodes which are difficult to back up, such as nodes for the brake pedal and the steering wheel, are given with the fail-operative function to be able to continue the operation. Further, when the self-monitoring function is itself failed, the node function is stopped to prevent runaway of the node.
- With the autonomous monitoring described above, a highly reliable system can be constructed as an assembly of fail-silent nodes that are comparatively low in cost. In addition, the fail-operative function at a system level can be realized with a combination with the autonomous backup described below.
- Of the autonomous decentralized control platform, the autonomous backup will be described. The intent of the autonomous backup is to ensure high reliability required in the vehicle control. More specifically, the autonomous backup provides a simplified control function to compensate for a failure occurred in the nodes constituting the decentralized vehicle control system.
- Thus, the term "autonomous backup" means the function of realizing the least necessary control with data sharing among slave nodes when a node having the master function is failed in a logical configuration in which control nodes operate in master-slave relation in a normal state.
- Fig. 17 shows an operation flow in an actuator node.
- Normally, the controller node A10 computes the control target value using the measured value from the sensor node A20, and the actuator node A30 controls the actuator AA30 in accordance with the computed control target value (i.e., in a sequence of Yes in step S311 → step S312 → step S313).
- On the other hand, the actuator node A30 incorporates a simplified version of the control function of the master node (controller node A10), i.e., a simple controller, A34 (see Fig. 13) and computes a simple control target value based on the measured sensor value while referring to the control target value and the measured sensor value at the same time. If an abnormality occurs in the master node, the function is stopped with the above-described self-monitoring function, and the actuator node A30 determines, in step S311, the occurrence of a failure in the master node by confirming, e.g., an event that the data in the data field DF10 is not updated. If the actuator node A30 determines the failure of the master node, processing is executed in a sequence of No in step S311 → step S314 → step S313. As a result, the actuator node A30 backs up the processing, which is required to realize its own function, by itself with the simplified control function A34.
- With that autonomous backup function and the autonomous monitoring function described before, a highly reliable fail-operative system can be realized as an assembly of fail-silent nodes that are comparatively low in cost.
- An example of operation of the autonomous decentralized control architecture will be described below in connection with, e.g., the brake control function. The following description is particularly intended to show that a fail-operative system can be constructed in a combination of failsafe nodes according to this embodiment.
- Figs. 18A and 18B show a configuration example of the XBW vehicle control system. In the example of Figs. 18A and 18B, an attention is focused on a vehicle motion integrated control ECU, a brake pedal position sensor, a brake actuator (BBW driver ECU), and a data field. The data field is provided on a vehicle control network that is installed according to, e.g., "FlexRay".
- First, the operation of the brake control function in the autonomous decentralized control platform in the normal state will be described with reference to Fig. 18A.
- The brake control function in the autonomous decentralized control platform is made up of a brake pedal node (smart sensor) B20, a vehicle motion integrated control node (ECU) (high-performance CPU) B10, and a brake actuator node (smart actuator) B30.
- The brake pedal node B20 autonomously starts up periodically and measures the status of the brake pedal position sensor SB20 by using an A/D converter B203.
- In the brake pedal node B20, the measured value is subjected to filtering and correction processes, etc. in a filtering/correction processing section B202, and then to data standardization in a data standardizing section B204. Thereafter, the brake pedal node B20 broadcasts the data "brake pedal status" to an autonomous decentralized data field DF30 by using a communication driver B201.
- The vehicle motion integrated control node B10 starts up periodically. After the startup, the vehicle motion integrated control node B10 refers to the brake pedal status and other data (such as the yaw rate and the steering angle) in the autonomous decentralized data field DF30 by using the communication driver B101, and estimates the vehicle motion status in a vehicle motion observer B102 and the intent of operation applied from the driver in a driver's intent confirming section B103. Based on the estimation results, an actuator target value generating section B104 computes actuator control target values such as the braking force, the drive axle torque, and the steering angle. Then, the vehicle motion integrated control node B10 broadcasts the computed control target values to the autonomous decentralized data field DF30 by using the communication driver B101.
- The operation of the brake actuator node B30 is described here, taking the rear left wheel as an example. As with the other nodes, the brake actuator node B30 also starts up periodically. After the startup, the brake actuator node B30 refers to the control target value, i.e., the target braking force, in the autonomous decentralized data field DF30 by using the communication driver B301. Then, a brake actuator AB30 is controlled in accordance with the target braking force. More specifically, the brake actuator node B30 observes the brake status through an A/D converter B303, and computes a value of the brake control variable in a brake caliper control section B302 based on the difference between the braking force actually generated by the brake and the braking force in the target state, followed by controlling the brake actuator AB30 with a predriver B304.
- The period of the operation referring to the data field and the period of the actuator control operation are not always required to be the same, and the period of the actuator control operation may be set so as to execute the control at a higher speed. This enables the control to be executed in a more appropriate manner adapted for the control time constant of the actuator as a control target.
- Next, the operation of the brake control function in the event of a failure of the vehicle motion integrated control node B10 will be described with reference to Fig. 18B.
- As in the normal state, the brake pedal node B20 autonomously starts up and executes the processing. The processing of the brake pedal node B20 is not affected by the failure of the vehicle motion integrated control node B10. Upon detecting its own failure with the autonomous management function, the vehicle motion integrated control node B10 executes the fail-silent process. In other words, the node B10 comes into a state where the processing therein is all stopped, looking from the exterior. Accordingly, the actuator control target values in the autonomous decentralized data field DF30 are no longer updated.
- The operation of the brake actuator node B30 in this case is described here, taking the rear left wheel as an example. The brake actuator node B30 starts up periodically. After the startup, the brake actuator node B30 refers to the control target value, i.e., the target braking force, in the autonomous decentralized data field DF30. At this time, it detects the failure of the vehicle motion integrated control node B10 based on the fact that data of the target braking force is no longer updated. Detection of the failure causes an autonomous decentralized control function B305 in the brake pedal node B20 to start up. The autonomous decentralized control function B305 refers to the brake pedal status in the autonomous decentralized data field DF30 and computes a simple target value.
- Then, the brake caliper control section B302 controls the brake actuator AB30 in accordance with the simple target value computed by the autonomous decentralized control function B305 instead of the control target value computed by the vehicle motion integrated control node B10.
- Incidentally, the simple target value provides a value computed using only the brake pedal status, and differs from the value that is computed by the vehicle motion integrated control node B10 and is adapted for controlling the vehicle behavior.
- The operation of the brake control function using the autonomous decentralized control platform has been described above. As seen from the above description, even if the controller node for computing the target value is failed, the vehicle control system can continue the operation with the respective functions of the data field, the autonomous operation, the autonomous management, and the autonomous backup, i.e., the features of the autonomous decentralized control platform.
- Such an effect is advantageous in realizing a fail-operative vehicle control system in combination with fail-silent nodes, and in constructing a highly reliable system at a lower cost.
- A basic configuration of the vehicle control system according to the second embodiment of the present invention will be described below with reference to Fig. 19.
- The vehicle control system comprises a
sensor 500 for detecting the driver's demand, asensor 550 for detecting the vehicle status, anactuator 400, an operationamount generating node 100, and anactuator driving node 300. - Among those components, the
sensor 500 for detecting the driver's demand, the operationamount generating node 100, and theactuator driving node 300 havefailure detecting functions failure detecting function 210C of theactuator driving node 300 has not only the self-diagnosis function, but also the function of detecting a failure of theactuator 400. - The operation
amount generating node 100 computes an operationamount command value 120 based on a driver'sdemand signal 200 and avehicle status signal 201. - The
actuator driving node 300 receives the operationamount command value 120 and controls theactuator 400, thereby performing the driving, steering, braking, etc. of the vehicle. - When any of the
failure detecting functions actuator 400, it outputs, to the exterior of the node, afailure detection notification 230 for notifying that the relevant node is in a failed state. All of the nodes with the failure detecting functions are designed so as to stop all outputs to the exterior, i.e., so as to become fail-silent, except for outputting thefailure detection notification 230 when they are in the failed state. - Fig. 20 is a functional block diagram of the operation
amount generating node 100. The operationamount generating node 100 stores a plurality of control logics (control A, control B, and control C) for the vehicle control and is designed to switch over the control logic depending on the position and severity of a failure when it receives thefailure detection notification 230 from any other node. - Fig. 21 is a functional block diagram of the
actuator driving node 300. Theactuator driving node 300 stores a plurality of control logics (control X, control Y, and control Z) for computing the operation target value of theactuator 400 based on the operationamount command value 120 generated by the operationamount generating node 100. Acontroller 320 drives theactuator 400 so that the operation target value is obtained. - The
actuator driving node 300 is designed to switch over the control logic depending on the position and severity of a failure when it receives thefailure detection notification 230 from any other node. When the operationamount command value 120 is receivable, theactuator driving node 300 executes the control X or Y in accordance with the received operationamount command value 120. However, when the operationamount command value 120 is not receivable due to a failure of the operationamount generating node 100 or a communication path, theactuator driving node 300 makes switching-over to execute the control Z for taking in the driver'sdemand signal 200 and computing the operation amount command value by itself. - A vehicle control system according to a third embodiment of the present invention will be described below with reference to Fig. 22. Fig. 22 shows an extracted portion of the vehicle control system, which is in particular related to the brake control and the steering control.
- The vehicle control system of this embodiment includes, as sensors for detecting the driver's demands, a
steering angle sensor 41 for measuring the rotational angle of asteering wheel 51 and a brakepedal position sensor 42 for measuring the step-down amount of abrake pedal 52. Also, the vehicle control system includes, as an operation amount generating node, a vehicle motion integratedcontrol ECU 30 for interpreting the driver's intent based on signals from the driver's demand detecting sensors and for controlling the vehicle motion in an integrated manner in combination with signals from other sensors (not shown) for detecting the vehicle status, such as an acceleration sensor, a yaw rate sensor, and a wheel speed sensor. - The vehicle control system further includes, as actuator driving nodes, an SBW/
VGR driver ECU 81 for controlling an electric motor M1 which generates a front wheel steering force and an electric motor M5 which acts on a variable gear ratio (VGR) mechanism mounted to a steering column shaft, anSBW driver ECU 82 for controlling a steering electric motor M2 which generates a rear wheel steering force, and BBW driver ECU's 83A - 83D for controlling brake motors M3A - M3D which generate braking forces for four wheels. - The sensor for measuring the operation amount applied to the brake pedal from the driver can also be given as a hydraulic sensor for measuring the hydraulic pressure generated upon the
brake pedal 52 being stepped down by the driver. - The above-mentioned nodes are all constituted to be fail-silent. A communication network comprises a main bus N1A and a backup bus N1B. The main bus N1A is connected to all the nodes, and the backup bus N1B is connected to the least necessary nodes related to safety in running of the vehicle, i.e., all other nodes than the vehicle motion integrated
control ECU 30 and the rear wheelSBW driver ECU 82. Though not shown, all the nodes connected to the backup bus N1B are supplied with at least dual source powers. - The front wheel SBW/
VGR driver ECU 81 and the four wheel BBW driver ECU's 83A - 83D incorporate simplifiedcontrol logic sections - In the normal state, the front wheel SBW/
VGR driver ECU 81, the rear wheelSBW driver ECU 82, and the four wheel BBW driver ECU's 83A - 83D receive a steering angle command and braking force commands from the vehicle motion integratedcontrol ECU 30 via the communication network, and then control the associated electric motors in accordance with the received command values. - In this embodiment, the
steering wheel 51 is mechanically coupled to a frontwheel steering mechanism 71, and thebrake pedal 52 is connected tofront wheel brakes 73 through a hydraulic system as well. Therefore, when electronic control is failed, the driver can directly steer and brake the vehicle by using those backup mechanisms. - Taking the vehicle control system shown in Fig. 22 as an example, a description is made of the feature that, even when a failure occurs anywhere in the vehicle control system, the vehicle can stably be driven without losing the braking and steering functions.
- Prior to starting the description, it is assumed that two or more failures will not occur at the same time, and that if there occurs a failure, the occurrence of the failure is alarmed to the driver and the failure is repaired in a comparatively short time to prevent the occurrence of a second failure.
- In this event, the vehicle motion integrated
control ECU 30 outputs a failure detection notification to the main bus N1A. By constituting the communication network to be adapted for time division multiple access (TDMA) such that each node issues an output to the network in a predetermined time slot, the absence of output can be used as indicating the occurrence of a failure instead of the failure detection notification. - Such a scheme can be realized, for example, by dividing a communication cycle into a data transmission cycle and a diagnosis cycle, and causing all the nodes to output some respective data in order in the diagnosis cycle, as shown in Fig. 23. In the example of Fig. 23, because no output is issued to the network in the time slot within the diagnosis cycle allocated for a node F, the other nodes can recognize that the node F is failed.
- Upon receiving the failure detection notification from the vehicle motion integrated
control ECU 30, the front wheel SBW/VGR driver ECU 81 and the rear wheelSBW driver ECU 82 take in the value measured by thesteering angle sensor 41 via the network and execute the simplified control. - Also, each of the four wheel BBW driver ECU's 83A - 83D takes in the value measured by the brake
pedal position sensor 42 and executes the simplified control in a simplifiedcontrol logic section 831. - In this event, the front wheel SBW/
VGR driver ECU 81, and the four wheel BBW driver ECU's 83A - 83D execute the simplified control by using the backup bus N1B in a similar manner to the event that the vehicle motion integratedcontrol ECU 30 is failed. - In this event, power supply to the front wheel brake motor on the failed side is stopped, thus bringing the relevant wheel into a brake disabled state. Then, the vehicle motion integrated
control ECU 30 executes control such that the vehicle is stably stopped with the remaining three wheels. As an alternative, the driver may directly stop the vehicle by using the backup mechanism. - Here, though not shown, the failure of the electric motor is assumed to include failures of a motor rotational position sensor, a current sensor, etc. which are required for the motor control. In the event that one of the rear wheel
BBW driver ECU - In this event, power supply to the front wheel steering motor M1 and the electric motor M5 acting on the
VGR mechanism 54 is stopped, and the driver directly steer the vehicle by using the backup mechanism. - In this event, power supply to the steering motors M1, M2, the electric motor M5 acting on the
VGR mechanism 54, and the brake motors M3A - M3D is stopped, and the driver directly steer or brake the vehicle by using the backup mechanism. - Incidentally, it is assumed in this embodiment that a single failure does not cause a situation where both the backup mechanisms for steering and braking must be used at the same time.
- With this embodiment, as described above, since an error is backed up through coordination in the entire system, a sufficiently high-reliable vehicle control system can be realized just by providing all the nodes with the fail-silent function in the vehicle control system including the backup mechanisms without increasing redundancy of each node beyond the least necessary level.
- The fail-silent node is simpler in hardware configuration than the fail-operative node capable of continuing the normal operation even if a failure occurs. Accordingly, this embodiment can provide the vehicle control system having higher reliability and a lower cost than the known system.
- Further, since only the least necessary nodes related to safety in running of the vehicle are connected to the backup bus N1B, the number of nodes requiring redundancy in communication interface can be reduced and hence the cost can be cut.
- An example of functional configuration of the fail-silent
steering angle sensor 41 or brakepedal position sensor 42 will be described with reference to Fig. 24. - The
steering angle sensor 41 or the brakepedal position sensor 42 comprises twosensor elements D converters sensor elements failure detecting function 210, afilter function 63, acommunication controller 64, acommunication driver 65A for outputting a signal to the main bus N1A, and acommunication driver 65B for outputting a signal to the backup bus N1B. - The
failure detecting function 210 has amatch checking function 62 for determining whether two A/D-converted values from the A/D converters communication driver 65A and thecommunication driver 65B are deactivated to become fail-silent. - Also, the
failure detecting function 210 outputs a trigger signal to the A/D converters sensor elements - With the configuration example described above, since the sensor includes the
filter function 63, the following advantage is obtained. Even when a sensor signal is sampled at a short period and is subjected to a filtering process such as oversampling, it is no longer required to output data to the communication network in match with the sampling period, whereby traffic of the communication network can be reduced. - An example of hardware configuration of the fail-silent
steering angle sensor 41 or the brakepedal position sensor 42 will be described with reference to Fig. 25. - The
steering angle sensor 41 or the brakepedal position sensor 42 comprises amain sensor element 60A, areference sensor element 60B, afailsafe LSI 600, and twocommunication drivers - The
failsafe LSI 600 comprises A/D converters communication controllers comparators RAM 67. - In the
failsafe LSI 600, after A/D-converting signals from thesensor elements - A match between the results of the filtering processes is checked by inputting the outputs of the
communication controllers comparators - In this hardware example, because there are two communication buses, the
communication controllers 64 are provided in two channels, and outputs of the two channels are compared with each other in each of thecomparators - According to this hardware example, since the failsafe function is realized in the form of one chip, the fail-silent sensor node can be constituted at a low cost.
- A vehicle control system according to a fourth embodiment of the present invention will be described below with reference to Fig. 26. Note that components in Fig. 26 corresponding to those in Fig. 22 are denoted by the same reference numerals as those in Fig. 22 and a description thereof is omitted here.
- While the sensors are directly connected to the network in the third embodiment shown in Fig. 22, this fourth embodiment is constituted such that sensor signals are inputted to an
HMI ECU 25, which executes comparison and filtering processes of sensor values and outputs the processed sensor data to the network. - In this fourth embodiment, a steering angle sensor 41A and a brake
pedal position sensor 42A are each made up of only two sensor elements. - Additionally, to avoid a situation where the driver must operate both the backup mechanisms for steering and braking in the event of a single failure, the
HMI ECU 25 is required to be fail-operative. - A vehicle control system according to a fifth embodiment of the present invention will be described below with reference to Fig. 27. Note that components in Fig. 27 corresponding to those in Fig. 22 are denoted by the same reference numerals as those in Fig. 22 and a description thereof is omitted here.
- The vehicle control system of the fifth embodiment has the same node and network configurations as those of the third embodiment, but it differs from the latter in that mechanical coupling is not present between the steering column (steering wheel 51) and the steering force generating mechanism and between the
brake pedal 52 and the braking force generating mechanism. Accordingly, the driver cannot steer and brake the vehicle by using the mechanical backup mechanisms as in the third embodiment. - In the vehicle control system of the fifth embodiment, therefore, a
steering angle sensor 41B, a brakepedal position sensor 42B, and aSBW driver ECU 81A for thefront wheels - Further, the steering motor for the
front wheels - Though not shown, the front wheel
SBW driver ECU 81A comprises two fail-silent nodes, and these fail-silent nodes control the doubled steering motors M1A, M1B independently of each other. The front wheelSBW driver ECU 81A includes a simplifiedcontrol logic section 811. - An increase of the cost resulting from doubling the electric motor can be suppressed by using, as the steering motors M1A, M1B, electric motors each of which has a capability of producing a smaller torque than the steering motor used in the system where the steering wheel and the steering force generating mechanism are mechanically coupled to each other (when a torque comparable to that in the mechanically coupled system should be produced, each of the electric motors used in this embodiment must have a capability of producing a 1/2 or larger torque as compared with the undoubled steering motor).
- Further, the front wheel
SBW driver ECU 81A controls an electric motor M6 acting on a mechanism that generates a reaction force from the road surface on the steering column in a pseudo manner. - The
steering angle sensor 41B and the brakepedal position sensor 42B are each constituted in the doubled form of the fail-silent sensor shown in Fig. 25. Alternatively, the fail-silent sensor shown in Fig. 25 may be replaced with a single fail-operative sensor having higher reliability in which the sensor element is tripled and the majority decision function for three sensor signals is additionally provided. - In the event that one fail-silent node of the front wheel
SBW driver ECU 81A or one of the steering motors M1A, M1B (including the sensors necessary for the motor control) is failed, either node stops power supply to the steering motor on the failed side and outputs a failure detection notification. - Upon receiving the failure detection notification, the vehicle motion integrated
control ECU 30 switches over the control so that the vehicle can stably be steered with the remaining steering motor. - If there occurs a failure in any other location, the vehicle is controlled to be able to run stably without disabling the braking and steering functions in the same manner as that described in the third embodiment.
- With the fifth embodiment, since an error is backed up through coordination in the entire system, a sufficiently high-reliable vehicle control system can be realized at a low cost just by introducing the least necessary number of the fail-operative nodes even in the vehicle control system in which the backup mechanisms for steering and braking are not provided.
- A vehicle control system according to a sixth embodiment of the present invention will be described below with reference to Fig. 28. Note that components in Fig. 28 corresponding to those in Figs. 3 and 22 are denoted by the same reference numerals as those in Fig. 22 and a description thereof is omitted here.
- In this sixth embodiment, nodes related to the driving system, the safety system, etc. are added to the vehicle control system of the third embodiment so as to represent an entire control system for running of the vehicle. While the illustrated sixth embodiment includes the backup mechanisms for steering and braking, even the vehicle control system not provided with the backup mechanisms for steering and braking can also be constituted in a similar way.
- Connected to a main bus N1A are not only the nodes related to the steering control and the braking control, which have been described above in connection with the third embodiment, but also a DBW-system integrated
control ECU 20 for controlling the driving system of the vehicle in an integrated manner, EAS driver ECU's 84A - 84D for controlling respectively suspension motors M4A - M4D to adjust damping forces, an acceleratorpedal position sensor 43 for measuring the step-down amount of anaccelerator pedal 53, a millimeter wave (EHF) radar/camera 44 for detecting external conditions of the vehicle, and anairbag ECU 85 for controlling expansion of an airbag. - A front wheel SBW/
VGR driver ECU 81 and four wheel BBW driver ECU's 83A - 83D incorporate respectively simplifiedcontrol logic sections - The DBW-system integrated
control ECU 20 is connected to anengine control ECU 21, atransmission control ECU 22, an electricmotor control ECU 23, and abattery control ECU 24 via a network N2. - The vehicle motion integrated
control ECU 30 is connected via a network N3 to aninformation system gateway 35 that serves as a gateway to the network for controlling devices in an information system, such as a car navigation unit, and to abody system gateway 36 that serves as a gateway to the network for controlling devices in an body system, such as door locks, door mirrors and various meters, thereby transferring data to and from those nodes. - Though not shown, the
airbag ECU 85 is also connected at a not-illustrated end to a safety system network for integration of various sensors and an actuator, which are required for expansion control of the airbag. - In this embodiment, the vehicle motion integrated
control ECU 30 interprets the driver's intent based on signals from asteering angle sensor 41, a brakepedal position sensor 42 and the acceleratorpedal position sensor 43, and computes the steering angle, the braking forces and the driving forces for realizing an optimum vehicle motion in combination with signals from other sensors (not shown) for detecting the vehicle status, such as an acceleration sensor, a yaw rate sensor, and a wheel speed sensor. Then, the vehicle motion integratedcontrol ECU 30 sends steering angle commands to a front wheel SBW/VGR driver ECU 81 and a rear wheelSBW driver ECU 82, sends braking force commands to four wheel BBW driver ECU's 83A - 83D, and sends a driving force command to the DBW-system integratedcontrol ECU 20. - The DBW-system integrated
control ECU 20 receives the driving force command, computes the driving forces to be generated from driving force generators, such as an engine and an electric motor, taking into account energy efficiency, etc., and sends the computed driving force commands to theengine control ECU 21, the electricmotor control ECU 23, etc. via the network N2. - The vehicle motion integrated
control ECU 30 can execute control, such as running to follow a vehicle running ahead, lane keeping running, and risk avoiding operation, by employing not only information from the sensors for detecting the driver's demand, but also information from the millimeter wave radar/camera 44 for detecting external conditions of the vehicle. - Looking at reliability, the nodes connected to the main bus N1A of the communication network are all constituted to be fail-silent. On the other hand, as described above in connection with the third embodiment, only the least necessary nodes related to safety in running of the vehicle are connected to the backup bus N1B. It is therefore possible to reduce the number of nodes that are each required to have a redundant communication interface, and to reduce the cost.
- The accelerator
pedal position sensor 43 is also directly connected to theengine control ECU 21 so that the vehicle can be driven even when one of the main bus N1A, the DBW-system integratedcontrol ECU 20, and the network N2 is failed. - A manner for backing up an error in this embodiment and resulting advantages are the same as those described above in connection with the third embodiment.
- A vehicle control system according to a seventh embodiment of the present invention will be described below with reference to Figs. 29 and 30.
- An operation
amount generating node 610 generates anoperation amount 612, and the generatedoperation amount 612 is sent to anactuator driving node 630. - A correction
amount generating node 620 generates acorrection amount 622, and the generatedcorrection amount 622 is sent to theactuator driving node 630. - As shown in Fig. 30, the
actuator driving node 630 includes acontroller 632 and aswitch 634. When the correctionamount generating node 620 is normal, thecorrection amount 622 from the correctionamount generating node 620 is added to theoperation amount 612 from the operationamount generating node 610, to thereby produce acontrol target value 635 for control of anactuator 640. On the other hand, when the correctionamount generating node 620 is abnormal, theoperation amount 612 from the operationamount generating node 610 is used as thecontrol target value 635 for control of anactuator 640. - With this embodiment, when the correction
amount generating node 620 is normal, the control can be performed in a finer manner by using the correction amount, and when the correctionamount generating node 620 is failed, the control can be continued without using the correction amount while the function is contracted. - Because it is required to know whether the correction
amount generating node 620 is normal, the correctionamount generating node 620 preferably includes afailure detecting function 621. Theswitch 634 of theactuator driving node 630 performs switching operation in accordance with afailure detection result 623 obtained with thefailure detecting function 621. - While a high level of information processing is required to generate the correction amount, comparatively simple information processing is required to generate the operation amount. Therefore, the correction
amount generating node 620 requires higher processing performance than the operationamount generating node 610. This makes it essential in the correctionamount generating node 620 to increase the number of parts, to raise the operation frequency (i.e., the processor's clock frequency), and to operate with less electrical and thermal allowances. As a result, the correctionamount generating node 620 has a higher failure rate (total of failure rates (in units of "fit") of the parts) than the operationamount generating node 610. - In other words, the correction
amount generating node 620 is constituted as a node having a higher processing capability than the operationamount generating node 610. For example, the correctionamount generating node 620 is constituted as a computer (node) having a higher operation frequency than the operationamount generating node 610. - Accordingly, the operation
amount generating node 610, i.e., the least necessary node to continue the control, is expected to have a lower failure rate than the correctionamount generating node 620. Stated another way, the operationamount generating node 610 is constituted as a node having the configuration with a lower failure rate than that of the correctionamount generating node 620. - Further, because the operation
amount generating node 610 must be kept normal even when the correctionamount generating node 620 is failed, the operationamount generating node 610 preferably has a failure withstandfunction 611. - The
failure detecting function 621 provided in the correctionamount generating node 620 can be practiced in various ways. As shown in Fig. 31, by way of example, thefailure detecting function 621 can be realized by providing the correctionamount generating node 620 double and comparing outputs of two nodes with each other. - Such a case can be practiced by a method of comparing
correction amounts 622a, 622b outputted from the doubled correctionamount generating nodes 620 with each other on the side of the correctionamount generating node 620, and transmitting one of the correction amounts 622a, 622b and a failure detection result to theactuator driving node 630, or by a method of, as shown in Fig. 32, transmitting the correction amounts 622a, 622b outputted from the doubled correctionamount generating nodes 620 to theactuator driving node 630, and comparing the correction amounts 622a and 622b with each other by acomparison function 631 in theactuator driving node 630, thereby obtaining afailure detection result 623. - The failure withstand
function 611 provided in the operationamount generating node 610 can also be practiced in various ways. As shown in Fig. 31, by way of example, the failure withstandfunction 611 can be realized by providing the operationamount generating node 610 in triple and selecting one of outputs from three nodes based on the majority decision. - Such a case can be practiced by a method of selecting one of operation amounts 612a, 612b and 612c outputted from the tripled operation
amount generating nodes 610 based on the majority decision beforehand on the side of the operationamount generating node 610, and transmitting the selected operation amount to theactuator driving node 630, or by a method of, as shown in Fig. 32, transmitting the operation amounts 612a, 612b and 612c outputted from the tripled operationamount generating nodes 610 to theactuator driving node 630, and selecting one of the three operation amounts based on the majority decision by amajority decision function 633 provided in theactuator driving node 630. - Alternatively, the configuration may be modified as shown in Fig. 33. More specifically, a
gain varying unit 636 and aramp generator 637 for controlling a gain of thegain varying unit 636 are provided in theactuator driving node 630. Thefailure detection result 623 is inputted to theramp generator 637. Then, thecorrection amount 622 from the correctionamount generating node 620 is multiplied by the variable gain in thegain varying unit 636, and the multiplied value is added to theoperation amount 612 from the operationamount generating node 610, thereby producing thecontrol target value 635 for control of anactuator 640. With this modification, in an abnormal state of the correctionamount generating node 620, thecontrol target value 635 is gradually changed without abrupt changes. - Fig. 34 represents the operation of this modification. When the correction
amount generating node 620 is normal, a ramp output 637' from theramp generator 637 takes a high-level value. Therefore, thecorrection amount 622 from the correctionamount generating node 620 is multiplied by a predetermined high-level gain in thegain varying unit 636, and the multiplied value is added to theoperation amount 612 from the operationamount generating node 610, thereby producing thecontrol target value 635 for control of theactuator 640. - On the other hand, when the correction
amount generating node 620 comes into an abnormal state, the ramp output 637' starts to gradually change from the high-level value to a low-level value with time upon the change of thefailure detecting result 623 from "normal" to "abnormal". - Accordingly, the variable gain to be multiplied by the
correction amount 622 from the correctionamount generating node 620 in thegain varying unit 636 is also gradually changed from a high-level gain to a low-level gain with time. As a result, thecorrection amount 622 from the correctionamount generating node 620, which is added to theoperation amount 612 for computing thecontrol target value 635, is gradually decreased with time. - While the low-level gain is set to 0 in this modification shown in Fig. 34, a value of the low-level gain may be decided depending on the severity of a failure occurred in the correction
amount generating node 620. Also, while the ramp output 637' is linearly changed from the high-level value to the low-level value in the illustrated modification, the change pattern is not limited to a linear form, but it may be set to any suitable form including a curve. In addition, it is desirable that the change pattern be a monotonously decreasing one. - With this modification described above, since the
control target value 635 is gradually changed without undergoing abrupt changes in the abnormal state of the correctionamount generating node 620, the driver can be kept away from an unusual feeling in the operation. Also, since there occurs no stepped difference in thecontrol target value 635 with the switching-over of the control, a deterioration of controllability can also be avoided which is otherwise caused due to a delay in response of the driver to the stepped difference in thecontrol target value 635. - Further, as shown in Fig. 35, the network configuration may be modified such that the
operation amount 612 from the operationamount generating node 610 and thecorrection amount 622 from the correctionamount generating node 620 are transmitted to theactuator driving node 630 via a single communication path (communication bus) 650. - With this modification, the communication paths are not required to be wired on the node-to-node basis, and hence savings in wiring are resulted. Correspondingly, the system cost can be cut and a weight reduction can be realized.
- Information transmitted via a
communication path 650 in this modification is, as shown in Fig. 36, subjected to time-division and allocated into a plurality of time slots in one-to-one relation to the nodes from which the information is transmitted. More specifically, theoperation amount 612 is transmitted while it is placed in atime slot 614 allocated to the operationamount generating node 610, and thecorrection amount 622 is transmitted while it is placed in atime slot 624 allocated to the correctionamount generating node 620. - When the above-mentioned method of separately transmitting the correction amounts 622a, 622b outputted from the correction
amount generating nodes 620 in redundant arrangement to theactuator driving node 630 is employed, separate time slots are allocated to the correctionamount generating nodes 620, and the correction amounts 622a, 622b are transmitted using the respective time slots. - Also, when the above-mentioned method of separately transmitting the operation amounts 612a, 612b and 612c generated from the operation
amount generating nodes 610 in redundant arrangement to theactuator driving node 630 is employed, separate time slots are allocated to the operationamount generating nodes 610, and the operation amounts 612a, 612b and 612c are transmitted using the respective time slots. - Fig. 37 shows a practical example in which the seventh embodiment is applied to the "Steer-by-Wire" system.
- A steering column (steering wheel) 615 is connected to the operation
amount generating node 610 to generate anoperation amount 612 that is a steering angle corresponding to the angle by which thesteering column 615 is operated by the driver. The generatedoperation amount 612 is transmitted to theactuator driving node 630 via thecommunication path 650. - An acceleration sensor/
yaw rate sensor 625 is connected to the correctionamount generating node 620 to generate acorrection amount 622 based on information including a signal from the acceleration sensor/yaw rate sensor 625 and theoperation amount 612. The generatedcorrection amount 622 is transmitted to theactuator driving node 630 via thecommunication path 650. - When the correction
amount generating node 620 is normal, theactuator driving node 630 controls asteering device 641 by using, as the control target value, a value resulting from adding thecorrection amount 622 to theoperation amount 612. - In the case of the driver overly turning the
steering column 615, the front wheels come out of the grip range and stability of the vehicle is deteriorated if thecorrection amount 622 is not added. With the example described above, however, since the acceleration sensor/yaw rate sensor 625 detects a sideslip or a spin of the vehicle and the correctionamount generating node 620 generates thecorrection amount 622 so as to suppress the sideslip or the spin, driving stability of the vehicle is improved. - Fig. 38 shows a practical example in which the seventh embodiment is applied to the "Brake-by-Wire" system.
- A
brake pedal 616 is connected to the operationamount generating node 610 to generate anoperation amount 612 that is a brake stepping-down force corresponding to the operation of thebrake pedal 616 applied from the driver. The generatedoperation amount 612 is transmitted to actuator driving nodes 630-1 through 630-4 via thecommunication path 650. - An acceleration sensor/
yaw rate sensor 625 is connected to the correctionamount generating node 620 to generate correction amounts 622-1 through 622-4 for the respective brakes based on information including a signal from the acceleration sensor/yaw rate sensor 625 and theoperation amount 612. The generatedcorrection amount 622 is transmitted to the actuator driving nodes 630-1 through 630-4 via thecommunication path 650. - When the correction
amount generating node 620 is normal, the actuator driving nodes 630-i (i = 1 - 4) control respective brakes 642-i (i = 1 - 4) of the four wheels by using, as the control target values, values resulting from adding the correction amounts 622-i (i = 1 - 4) to theoperation amount 612. - In the case of the driver overly stepping down the
brake pedal 616, the four wheels come out of the grip range and stability of the vehicle is deteriorated if the correction amounts 622-i (i = 1 - 4) are not added. With the example described above, however, since the acceleration sensor/yaw rate sensor 625 detects a sideslip or a spin of the vehicle and the correctionamount generating node 620 generates the correction amounts 622-i (i = 1 - 4) so as to suppress the sideslip or the spin, driving stability of the vehicle is improved. - Fig. 39 shows a practical example in which the seventh embodiment is applied to an integrated system of "Steer-by-Wire" and "Brake-by-Wire".
- The
steering column 615 and thebrake pedal 616 are connected to the operationamount generating node 610 to generate an operation amount 612-0 that is a steering angle corresponding to the angle by which thesteering column 615 is operated by the driver, and also to generate an operation amount 612-2 that is a brake stepping-down force corresponding to the operation of thebrake pedal 616 applied from the driver. The generated operation amounts 612-0, 612-2 are transmitted to the actuator driving nodes 630-0 through 630-4 via thecommunication path 650. Correction amounts 622-0 through 622-4 are generated and transmitted to the actuator driving nodes 630-0 through 630-4 in a similar manner to that in the above-described example. - When the correction
amount generating node 620 is normal, the actuator driving node 630-0 controls thesteering device 641 by using, as the control target value, a value resulting from adding the correction amount 622-0 to the operation amount 612-0. - When the correction
amount generating node 620 is normal, the actuator driving nodes 630-i (i = 1 - 4) control respective brakes 642-i (i = 1 - 4) of the four wheels by using, as the control target values, values resulting from adding the correction amounts 622-i (i = 1 - 4) to the operation amount 612-2. - In the case of the driver overly turning the
steering column 615 or overly stepping down thebrake pedal 616, the front wheels or the four wheels come out of the grip range and stability of the vehicle is deteriorated if the correction amounts 622-i (i = 1 - 4) are not added. With the example described above, however, since the acceleration sensor/yaw rate sensor 625 detects a sideslip or a spin of the vehicle and the correctionamount generating node 620 generates the correction amounts 622-i (i = 1 - 4) so as to suppress the sideslip or the spin, driving stability of the vehicle is improved. - A vehicle control system according to an eighth embodiment of the present invention will be described below with reference to Fig. 40.
- The vehicle control system according to this eighth embodiment comprises at least one
sensor 500 for detecting an operation amount that is applied to an accelerator pedal, a brake pedal, a steering wheel, etc. and represents the driver's demand for the vehicle motion; at least onesensor 550 for detecting a vehicle speed, an acceleration or a yaw rate that represents the vehicle status, or information indicating an external situation, which is acquired using, e.g., electric waves or an image; a plurality ofactuators 400 corresponding to a motive power source, brakes, and a steering wheel for realizing driving, braking and steering operations, respectively; an operationamount generating node 100 for generating target operation amounts to control theactuators 400; and a plurality ofactuator driving nodes 300 for controlling theactuators 400 in accordance with the target operation amounts generated by the operationamount generating node 100. - The operation
amount generating node 100 may be constituted, though not specifically shown, as a general microcomputer comprising a central processing unit (CPU) for executing programs, a nonvolatile memory (ROM) and a volatile memory (RAM) for storing the programs and data, and an input/output unit (I/O) for connection to thesensor 500, thesensor 550 and theactuator driving nodes 300, these components being interconnected via a two-way bus. - The operation
amount generating node 100 may further comprise an analog/digital converter (ADC) to which thesensor 500 and thesensor 550 are connected, or comprise a serial communication interface (SCI) to which thesensor 500, thesensor 550 and theactuator driving nodes 300 are connected. Further, those components may be realized as one or a plurality of semiconductor integrated circuits. - The operation
amount generating node 100 computes the target operation amount for each actuator 400 based on a driver'sdemand signal 200 outputted from thesensor 500 and avehicle status signal 201 outputted from thesensor 550, and then transmits the computed target operation amount, as an operationamount command value 120, to the correspondingactuator driving node 300 via a network. The operationamount command value 120 is decided depending on the type of each actuator 400, and it is a target driving force when theactuator 400 is the power source, a target braking force applied to one of four wheels when theactuator 400 is the brake, and a target steering angle when theactuator 400 is the steering wheel. - Each of the
actuator driving nodes 300 may be constituted, though not specifically shown, as a general microcomputer comprising a central processing unit (CPU) for executing programs, a nonvolatile memory (ROM) and a volatile memory (RAM) for storing the programs and data, an input/output unit (I/O) for connection to thesensor 500 and the operationamount generating node 100, these components being interconnected via a two-way bus, and driving circuits connected to the I/O and driving the actuators. - The
actuator driving node 300 may further comprise an analog/digital converter (ADC) to which thesensor 500 is connected, or comprise a serial communication interface (SCI) to which thesensor 500 and the operationamount generating node 100 are connected. Further, those components may be constituted as one or a plurality of semiconductor integrated circuits. - The
actuator driving node 300 includes, though not shown, a sensor for detecting one of the driving force, the braking force and the steering angle to be applied from theactuator 400, or for obtaining information required to estimate one of them, and executes driving control of theactuator 400 so that the driving force, the braking force or the steering angle applied from theactuator 400 is matched with the operationamount command value 120 received from the operationamount generating node 100. - Further, the
actuator driving nodes 300 transmits, to the operationamount generating node 100, the driving force, the braking force or the steering angle that is applied from theactuator 400 and is detected by the sensor. By referring to the thus-transmitted driving force, braking force and steering angle applied from theactuator 400, the operationamount generating node 100 can compute the target operation amount of eachactuator 400. - The
sensor 500, the operationamount generating node 100, and theactuator driving nodes 300 include respectivelyfailure detecting functions - Detection of a failure in the
sensor 500 with thefailure detecting function 210A can be realized by determining whether the value detected by thesensor 500 departs from a predetermined range, or by employing a plurality of sensors and evaluating detection results through comparison check or majority decision. - Detection of a failure in the operation
amount generating node 100 with thefailure detecting function 210B can be realized by resorting to timeout of the CPU with a watch dog timer, bit error detection in the ROM, the RAM and the two-way bus with redundant code, or I/O comparison check, or by employing a plurality of operationamount generating nodes 100 and evaluating respective node outputs through comparison check or majority decision. - Detection of a failure in the
actuator driving node 300 with thefailure detecting function 210C can be realized by resorting to timeout of the CPU with a watch dog timer, bit error detection in the ROM, the RAM and the two-way bus with redundant code, or I/O comparison check, or by employing a plurality of operationamount generating nodes 100 and evaluating respective node outputs through comparison check or majority decision. - In addition, the
failure detecting function 210C has the function of detecting a failure of theactuator 400 based on a change amount of the driving force, the braking force or the steering angle applied from theactuator 400 or the difference between the operationamount command value 120 and the actual value. - When each of the
failure detecting functions actuator 400, it outputs, to the operationamount generating node 100 and the otheractuator driving nodes 300, afailure detection notification 230 for notifying that the relevant node is in a failed state. - When any of the
sensor 500, the operationamount generating node 100, and theactuator driving nodes 300 comes into a failed state, it preferably outputs only thefailure detection notification 230 and stops the other outputs. Further, it is preferable that, when thefailure detection notification 230 cannot be outputted in a normal manner, the output of thefailure detection notification 230 is also stopped. - In addition, each
actuator driving node 300 has the control program selecting function (control method selecting means) 220 for selecting a control program (i.e., an actuator control method) in accordance with the failure detection results made by itself, the other actuator driving node(s) 300, and the operationamount generating node 100. - In the normal state, the control
program selecting function 220 selects a control program for controlling theactuator 400 in accordance with the operationamount command value 120 transmitted from the operationamount generating node 100. However, when the operationamount generating node 100 is failed, the controlprogram selecting function 220 selects a control program for controlling theactuator 400 in accordance with the driver'sdemand signal 200 from thesensor 500. Also, when the relevantactuator driving node 300 or the other particularactuator driving node 300 is failed, the controlprogram selecting function 220 selects a control program for safely stopping the control of theactuator 400. - As a result, even if the operation
amount generating node 100 or theactuator driving node 300 is failed, the vehicle control can be continued by using theactuator driving node 300 in the normal state. - The vehicle control system according to this eighth embodiment may be modified, as shown in Fig. 41, such that the operation
amount generating node 100, theactuator driving nodes 300, and thesensor 500 are interconnected via anetwork 600, such as a CAN, for communication among them. The operationamount generating node 100, theactuator driving nodes 300, and thesensor 500 can send the operationamount command value 120, thefailure detection notification 230, the driver'sdemand signal 200, and other messages to the desired nodes via thenetwork 600. Further, the plurality of nodes can receive the message sent from each node. - Alternatively, the vehicle control system according to the eighth embodiment may be constituted, as shown in Fig. 42, such that the
sensor 550 is also connected as one node to thenetwork 600. This enables thesensor 550 to send thevehicle status signal 201 to the desired node via thenetwork 600. Further, the plurality of nodes can receive the message sent from thesensor 550. - The vehicle control systems shown in Figs. 41 and 42 may be modified such that a plurality of
networks 600 are included for the purpose of improving network reliability with redundancy. - Fig. 43 is a functional block diagram of the operation
amount generating node 100. The operationamount generating node 100 stores a plurality of control programs (A, B and C) for the vehicle control in the ROM or RAM and is designed so as to switch over the control program depending on the position and severity of a failure when the operationamount generating node 100 detects its own failure with thefailure detecting function 210B or receives thefailure detection notification 230 from thesensor 500, thesensor 550 and any of theactuator driving nodes 300. - Fig. 44 is a functional block diagram of the
actuator driving node 300. Theactuator driving node 300 stores a plurality of control programs (X, Y and Z) in the ROM or RAM for computing the operation target value of theactuator 400 based on the operationamount command value 120 received from the operationamount generating node 100. More specifically, theactuator driving node 300 stores the control program X for controlling theactuator 400 in accordance with the operationamount command value 120 outputted from the operationamount generating node 100, the control program Y for controlling theactuator 400 in accordance with the driver'sdemand signal 200 outputted from thesensor 500, and the control program Z for maintaining theactuator 400 in a predetermined state regardless of the operationamount command value 120 and the driver'sdemand signal 200. Then, theactuator driving node 300 is able to switch over the control program depending on the situation of its own failure or a failure in another node with the controlprogram selecting function 220. - Basic processing to continue the vehicle motion in the event of a failure occurred in the vehicle control system will be described below in connection with, by way of example, the vehicle control systems shown in Figs. 40 through 44.
- A description is first made of the basic processing in the event of a failure of the operation
amount generating node 100. When the operationamount generating node 100 detects its own failure with the failure detecting function, it stops the transmission of the operationamount command value 120 and transmits thefailure detection notification 230. If the operationamount generating node 100 cannot transmit thefailure detection notification 230 in a normal manner, it further stops the transmission of thefailure detection notification 230 as well. - Accordingly, each of the
actuator driving nodes 300 connected to thenetwork 600 can detect the occurrence of a failure in the operationamount generating node 100 by receiving thefailure detection notification 230 from the operationamount generating node 100, or detect the occurrence of any abnormality in the operationamount generating node 100 by confirming that the operationamount command value 120 is not received within a preset time. - By constituting the
network 600 to be adapted for time division multiple access (TDMA) such that each node transmits a message to the network in a predetermined time slot, the occurrence of any abnormality in the operationamount generating node 100 can be detected by confirming whether data is received or not in the time slot allocated to the operationamount generating node 100 for the transmission of the operationamount command value 120. - When the
actuator driving node 300 detects thefailure detection notification 230 from the operationamount generating node 100 or detects non-reception of the operationamount command value 120, it switches over the control program from (X) to (Y) and takes in the driver'sdemand signal 200 from thesensor 500 via thenetwork 600, thereby executing control of the vehicle motion control, i.e., control of the driving force, the braking force, the steering angle, etc. - As a result, the vehicle motion control can be continued even if the operation
amount generating node 100 is failed. - Next, a description is made of the basic processing in the event of a failure of the
actuator driving node 300 or theactuator 400. Note that, though not shown, the failure of theactuator 400 is assumed to include failures of a rotational position sensor, a current sensor, etc. which are required for the actuator control. - In the event of a failure in any of the
actuator driving nodes 300 or theactuators 400 provided in one-to-one relation to the brakes of the four wheels, when theactuator driving node 300 detects its own failure with the failure detecting function, it transmits thefailure detection notification 230 and switches over the control program from (X) to (Z), thereby releasing the brake for the relevant wheel. - Upon receiving the
failure detection notification 230, the operationamount generating node 100 controls the braking force with two or three of the remaining wheels in the normal state. Alternatively, the driver may directly apply brake to the vehicle by using a mechanical backup mechanism, such as a hydraulic mechanism. - As a result, the vehicle motion control can be continued even if any of the
actuator driving nodes 300 or theactuators 400 provided in one-to-one relation to the brakes of the four wheels is failed. - In the event of a failure of the
actuator driving node 300 or theactuator 400 provided in association with the steering wheel, when theactuator driving node 300 detects its own failure with thefailure detecting function 210C, it transmits thefailure detection notification 230 and switches over the control program from (X) to (Z), thereby stopping the steering angle control. - Then, the driver directly steers the vehicle by using a mechanical backup mechanism, such as a steering column.
When the mechanical backup mechanism is not provided, plural pairs of theactuator driving node 300 and theactuator 400 are provided in association with the steering wheel, and the steering angle control is continued using at least one pair of theactuator driving node 300 and theactuator 400. - As a result, the vehicle motion control can be continued even if the
actuator driving node 300 or theactuator 400 provided in association with the steering wheel is failed. - In the event of a failure of the
actuator driving node 300 or theactuator 400 provided in association with the driving force, when theactuator driving node 300 detects its own failure with the failure detecting function, it transmits thefailure detection notification 230 and switches over the control program from (X) to (Z), thereby stopping the driving force control. - As a result, the vehicle can safely be stopped even if the
actuator driving node 300 or theactuator 400 provided in association with the driving force is failed. - In the event of a failure of the
sensor 500 for the brake pedal, the brakes for all the wheels are released and the driver directly applies a brake to the vehicle by using the mechanical backup mechanism, such as the hydraulic mechanism. When the mechanical backup mechanism is not provided, a plurality ofbrake pedal sensors 500 are provided such that the driver's demand can be detected by at least one of thebrake pedal sensors 500. - As a result, the vehicle motion control can be continued even if the
brake pedal sensor 500 is failed. - In the event of a failure of the
sensor 500 for the steering wheel, the steering control is stopped and the driver directly steers the vehicle by using the mechanical backup mechanism, such as the steering column. When the mechanical backup mechanism is not provided, a plurality ofsteering wheel sensors 500 are provided such that the driver's demand can be detected by at least one of thesteering wheel sensors 500. - As a result, the vehicle motion control can be continued even if the
steering wheel sensor 500 is failed. - In the event of a failure of the
sensor 500 for the accelerator pedal, the driving force control is stopped and the vehicle is stably stopped. Alternatively, a plurality ofaccelerator pedal sensors 500 are provided such that the driver's demand can be detected by at least one of theaccelerator pedal sensors 500. - As a result, the vehicle motion control can be continued.
- In the event of a failure of the
sensor 550, the operationamount generating node 100 continues the vehicle motion control in accordance with thevehicle status signal 201 obtained in a normal manner and the driver'sdemand signal 200 obtained from thesensor 500. - With this embodiment, as described above, since the operation
amount generating node 100 and theactuator driving nodes 300 back up mutually, there is no need of adding a redundant backup system. - If the operation
amount generating node 100 is failed, theactuator driving nodes 300 execute respective control processes independently of one another. - To that end, the
actuator driving nodes 300 are each required to be able to detect the failure of the operationamount generating node 100. It is also required that, even when a part of theactuator driving nodes 300 is failed in addition to the vehicle motion integratedcontrol ECU 30, the vehicle can stably be controlled with the remainingactuator driving nodes 300. In particular, if there occurs a difference between the braking forces applied from the brakes for the left and right wheels, the vehicle is apt to spin under the braking in an unbalanced state. - An example of respective operations of the operation
amount generating node 100 and theactuator driving node 300 to avoid such a risky state will be described below with reference to Figs. 45 through 57. A description of those operations is made of, by way of example, brake control. - The operation
amount generating node 100 repeatedly executes a brake control process at a certain control period (A). The control period is decided depending on a degree of accuracy required for the brake control in the vehicle. On the other hand, as described in detail below, each of theactuator driving nodes 300 repeatedly executes the braking force control of theactuator 400 at a control period (B) shorter than the control period (A) set for the operationamount generating node 100. The reason is that theactuator 400 requires higher accuracy in a current feedback control. - Accordingly, while the operation
amount generating node 100 executes a series of processing steps at the control period (A), eachactuator driving node 300 repeatedly executes the braking force control at the control period (B) in accordance with the latest operationamount command value 120, and the braking force control is not interrupted by, e.g., a communication process with respect to the operationamount generating node 100. - Fig. 45 is a time chart showing the operation of the
actuator driving node 300. The horizontal axis represents the lapse of time in a direction from the left to the right. Eachactuator driving node 300 repeatedly executes the following process at the control period (B). - First, the
actuator driving node 300 confirms whether it has received the operationamount command value 120 or thefailure detection notification 230 from the operationamount generating node 100 and the driver'sdemand signal 200 from the sensor 500 (B1: confirmation of reception of the command value and the failure detection notification). Because those items are sent at intervals of the control period (A), it is possible to confirm the reception of the operationamount command value 120 and the driver'sdemand signal 200 by using a timer that measures the time of the control period (A). As an alternative, the reception of the operationamount command value 120 and the driver'sdemand signal 200 can also be confirmed by employing a network of the time division multiple access (TDMA) type, and sending and receiving those items in predetermined time slots. - Then, the
actuator driving node 300 sends the braking force of theactuator 400 finally detected in the preceding control period and the diagnosis result of thefailure detecting function 210C to the operationamount generating node 100 and the other actuator driving node(s) 300 (B2: sending of a response message). At this time, when theactuator driving node 300 does not receive the operationamount command value 120 in routine of B1 (confirmation of reception of the command value and the failure detection notification) and recognizes the non-reception of the operationamount command value 120 as thefailure detection notification 230, it further acknowledges the reception of thefailure detection notification 230 together. Those items are sent as one response message in the collected form. - Then, the
actuator driving node 300 selects the control program based on the presence or absence of reception of the operationamount command value 120, the presence or absence of reception of thefailure detection notification 230, the presence or absence of a failure of theactuator 400 and in itself, as well as the presence or absence of a response message from the otheractuator driving node 300 and the contents of the response message (B3: selection of the control program). The control program includes the control program (X) for executing the braking force control in accordance with the operationamount command value 120, the control program (Y) for executing the braking force control in accordance with the driver'sdemand signal 200, and the control program (Z) for releasing the brakes regardless of the operationamount command value 120 and the driver'sdemand signal 200. One of these control programs is selected. - That control program selection routine (B3) will be described with reference to a flowchart of Fig. 46.
- First, the occurrence of an abnormality in the relevant
actuator driving node 300 itself or the associatedactuator 400 is determined based on conditions given below (step S1610).
Condition 1: a failure is detected as a result of diagnosis on itself or the actuator.
Condition 2: when the relevantactuator driving node 300 has received thefailure detection notification 230 from the operationamount generating node 100, the other two or moreactuator driving nodes 300 response that they have not received thefailure detection notification 230.
Condition 3: when the relevantactuator driving node 300 has not received thefailure detection notification 230 from the operationamount generating node 100, the other two or moreactuator driving nodes 300 response that they have received thefailure detection notification 230.
Condition 4: when the relevantactuator driving node 300 has received the operationamount command value 120 from the operationamount generating node 100, the other two or moreactuator driving nodes 300 response that they have not received the operationamount command value 120.
Condition 5: when the relevantactuator driving node 300 has not received the operationamount command value 120 from the operationamount generating node 100, the other two or moreactuator driving nodes 300 response that they have received the operationamount command value 120. - If at least one of the
above conditions 1 through 5 is satisfied, theactuator driving node 300 determines its own abnormal state and selects the control program (Z), thereby releasing the brakes (step S1680). - Then, the occurrence of an abnormality in the operation
amount generating node 100 is determined based on conditions given below (step S1620).
Condition 6: the relevantactuator driving node 300 has received thefailure detection notification 230 from the operationamount generating node 100, and the other two or moreactuator driving nodes 300 response that they have also received thefailure detection notification 230.
Condition 7: the relevantactuator driving node 300 has not received the operationamount command value 120 from the operationamount generating node 100, and the other two or moreactuator driving nodes 300 response that they have also not received the operationamount command value 120. - If neither the
condition 6 nor thecondition 7 is satisfied, theactuator driving node 300 determines that the operationamount generating node 100 is normal. Then, thenode 300 selects the control program (X) (step S1660) to execute the braking force control in accordance with the operationamount command value 120. - On the other hand, if at least one of the
conditions actuator driving node 300 determines that the operationamount generating node 100 is abnormal. Then, thenode 300 determines the occurrence of an abnormality in the otheractuator driving node 300 or the associatedactuator 400 based on conditions given below (step S1630).
Condition 8: any otheractuator driving node 300 notifies the occurrence of a failure.
Condition 9: the other oneactuator driving node 300 sends no response message.
Condition 10: when the relevantactuator driving node 300 has received thefailure detection notification 230 from the operationamount generating node 100, only the other oneactuator driving node 300 responses that it has not received thefailure detection notification 230.
Condition 11: when the relevantactuator driving node 300 has not received thefailure detection notification 230 from the operationamount generating node 100, only the other oneactuator driving node 300 responses that it has received thefailure detection notification 230.
Condition 12: when the relevantactuator driving node 300 has received the operationamount command value 120 from the operationamount generating node 100, only the other oneactuator driving node 300 responses that it has not received the operationamount command value 120.
Condition 13: when the relevantactuator driving node 300 has not received the operationamount command value 120 from the operationamount generating node 100, only the other oneactuator driving node 300 responses that it has received the operationamount command value 120. - If none of the conditions 8 through 13 is satisfied, the relevant
actuator driving node 300 determines that the otheractuator driving nodes 300 and the associatedactuators 400 are normal. Then, thenode 300 selects the control program (Y) (step S1670) to execute the braking force control in accordance with the driver'sdemand signal 200. - On the other hand, if at least one of the conditions 8 through 13 is satisfied, the relevant
actuator driving node 300 determines that the otheractuator driving node 300 or the associatedactuator 400 is abnormal. Then, thenode 300 refers to a later-described control program selection table (step S1640) and selects the control program (Y) or (Z) (step S1650), thereby avoiding the braking in an unbalanced state. - As described above, the
actuator driving node 300 determines, based on theconditions 1 through 13, the occurrence of an abnormality in itself or the associatedactuator 400, the occurrence of an abnormality in the operationamount generating node 100, and the occurrence of an abnormality in the otheractuator driving node 300 or the associatedactuator 400, followed by selecting the control program. - Because the above conditions depend on detailed specifications of the vehicle system and its components, they may be modified corresponding to the specifications in practical use.
- Also, instead of determining the occurrence of an abnormality immediately upon detecting the non-reception of the operation
amount command value 120 or the relevantfailure detection notification 230 from the operationamount generating node 100, the occurrence of an abnormality may be determined when the non-reception has been confirmed two or more times. In this case, the number of times of the non-reception may be coincident among theactuator driving nodes 300 by exchanging the data indicative of the number of times of the non-reception among theactuator driving nodes 300 and making the majority decision on values of the exchanged data. - Figs. 47A and 47B each show a control program selection table.
- The table shown in Fig. 47A is used in the case of selecting the control program so as to brake the vehicle by using, of the four wheel brakes, the brakes of two front or rear wheels when the other
actuator driving node 300 or the associatedactuator 400 is abnormal. - On the other hand, the table shown in Fig. 47B is used in the case of selecting the control program so as to brake the vehicle by using, of the four wheel brakes, the brakes of one front wheel and one rear wheel in diagonal relation when the other
actuator driving node 300 or the associatedactuator 400 is abnormal. - Those tables are premised on that, when the vehicle cannot be braked by using the brake for any of two front or rear wheels or any of one front wheel and one rear wheel in diagonal relation, the brakes applied from all the
actuators 400 are released and the driver brakes the vehicle through the hydraulic mechanism. - Even in such a case, brake may of course be applied to the vehicle from the remaining
normal actuators 400. - In the absence of the hydraulic backup mechanism, even when the vehicle cannot be braked by using the brake for any of two front or rear wheels or any of one front wheel and one rear wheel in diagonal relation, brake must be applied to the vehicle from the remaining
normal actuators 400. In this case, preferably, the engine revolution speed is controlled to reduce the vehicle speed so that the influence of the braking in an unbalanced state is suppressed. - Returning to Fig. 45, after the completion of the control program selection, the
actuator driving node 300 computes the braking force and executes the brake control (B4). Thereafter, it takes in the actual braking force and collects failure information (B5). - Fig. 48 is a time chart showing the operations of the operation
amount generating node 100 and theactuator driving node 300 at the start timing of brake control. The horizontal axis represents the lapse of time in a direction from the left to the right. - First, upon detecting the step-down of the brake pedal by the driver, the operation
amount generating node 100 sends a braking start notification to theactuator driving nodes 300 for the four wheels (1810). - Upon receiving the braking start notification, each of the
actuator driving nodes 300 executes self-diagnosis on its own failure and failure diagnosis on theactuator 400 with thefailure detecting function 210C (1820), and it sends the diagnosis result as a response message to the operation amount generating node 100 (1830). Eachactuator driving node 300 receives the diagnosis results sent from the otheractuator driving nodes 300 via mutual communication. - The operation
amount generating node 100 receives the diagnosis results from theactuator driving nodes 300 and selects the wheels to be subjected to the brake control depending on the presence or absence of a failed node and the position of the failed node (1840). If anyactuator driving node 300 has not sent the diagnosis result, that node is regarded as being failed. Alternatively, the braking start notification may be sent again for prompting theactuator driving nodes 300 to send the diagnosis results once more or several more times. - The operation
amount generating node 100 computes the target operation amount for each of the wheels to be subjected to the brake control (1850), and sends the operationamount command value 120 to the corresponding actuator driving node 300 (1860). - Upon receiving the operation
amount command value 120, eachactuator driving node 300 updates a target value of the braking force control and executes the braking force control of the actuator 400 (1870). - Also, each
actuator driving node 300 sends the results of detection of the braking force applied from theactuator 400 and periodic diagnosis with thefailure detecting function 210C, as a response message, to the operationamount generating node 100 at a constant period (1880). At this time, eachactuator driving node 300 receives the detection and diagnosis results sent from the otheractuator driving nodes 300 via mutual communication. - Fig. 49 is a time chart showing the operations of the operation
amount generating node 100 and theactuator driving node 300 during the brake control. The horizontal axis represents the lapse of time in a direction from the left to the right. - The operation
amount generating node 100 executes a series of processing steps given below per control period (A) . - First, the operation
amount generating node 100 receives the response message from each actuator driving node 300 (1910). By referring to the failure diagnosis result of eachactuator driving node 300, which is contained in the response message, the operationamount generating node 100 confirms the presence or absence of an abnormality and the position of the abnormality in eachactuator driving node 300 and theactuator 400, and selects theactuator driving nodes 300 to be subjected to the brake control (1920). - Then, the operation
amount generating node 100 computes the target operation amount for each of the wheels to be subjected to the brake control (1930), and sends the operationamount command value 120 to the corresponding actuator driving node 300 (1940). - In Fig. 49, the brake control is started after the operation
amount generating node 100 has detected the step-down of the brake pedal by the driver and has sent the braking start notification to theactuator driving nodes 300 for the four wheels. By regarding that the presence or absence of the step-down of the brake pedal by the driver represents a difference in amount of the driver's demand, however, the operationamount generating node 100 may always repeatedly execute the series of processing steps at the control period (A), as shown in Fig. 49, regardless of the presence or absence of the step-down of the brake pedal by the driver. - Fig. 50 is a flowchart showing a process for selecting wheels on which the brake control is to be executed.
- First, the operation
amount generating node 100 determines the occurrence of an abnormality in itself or based on conditions given below (step S2010).
Condition 1: a failure is detected as a result of self-diagnosis with thefailure detecting function 210B.
Condition 2: the operationamount generating node 100 does not receive the response messages from the three or moreactuator driving nodes 300. - If at least one of the
above conditions amount generating node 100 determines itself being abnormal. Then, thenode 100 sends thefailure detection notification 230 to the actuator driving nodes 300 (step S2040) and stops the transmission of the operation amount command value 120 (step S2050). - On the other hand, if neither the
condition 1 nor thecondition 2 is satisfied, the operationamount generating node 100 determines itself being normal and then determines the occurrence of an abnormality in theactuator driving nodes 300 or theactuators 400 based on conditions given below (step S2020).
Condition 3: the operationamount generating node 100 receives thefailure detection notification 230 from anyactuator driving node 300.
Condition 4: the operationamount generating node 100 does not receive the response message from the two or lessactuator driving node 300. - If neither the
condition 3 nor thecondition 4 is satisfied, the operationamount generating node 100 determines that all of theactuator driving nodes 300 and the actuators 140 are normal. Then, thenode 100 executes the braking force control for all the four wheels (step S2070). - On the other hand, if at least one of the
conditions amount generating node 100 determines that anyactuator driving node 300 or the associatedactuator 400 is abnormal. Then, thenode 100 refers to a later-described braked wheel selection table (step S2030), and executes the braking force control with the selected wheels (step S2060), thereby avoiding the braking in an unbalanced state. - As described above, the operation
amount generating node 100 determines, based on theconditions 1 through 4, the occurrence of an abnormality in itself and the occurrence of an abnormality in anyactuator driving node 300 or the associatedactuator 400. If the operationamount generating node 100 is normal, it executes the brake control so as to avoid the braking in an unbalanced state by using the normalactuator driving nodes 300. If the operationamount generating node 100 is abnormal itself, it stops the brake control for transition to the autonomous brake control with theactuator driving nodes 300. - Because the above conditions depend on detailed specifications of the vehicle system and its components, they may be modified corresponding to the specifications in practical use. Also, instead of determining the occurrence of an abnormality immediately upon detecting the non-reception of the response message from any
actuator driving node 300, the occurrence of an abnormality may be determined when the non-reception has been confirmed two or more times. - Figs. 51A and 51B each show a braked wheel selection tables.
- The table shown in Fig. 51A is used in the case of selecting the braked wheels so as to brake the vehicle by using, of the four wheel brakes, the brakes of two front or rear wheels when any
actuator driving node 300 or the associatedactuator 400 is abnormal. - On the other hand, the table shown in Fig. 51B is used in the case of selecting the braked wheels so as to brake the vehicle by using, of the four wheel brakes, the brakes of one front wheel and one rear wheel in diagonal relation when any
actuator driving node 300 or the associatedactuator 400 is abnormal. - Those tables are premised, though not shown, on that, when the vehicle cannot be braked by using the brake for any of two front or rear wheels or any of one front wheel and one rear wheel in diagonal relation, the operation
amount generating node 100 computes the operationamount command value 120 so as to release the brakes applied from all theactuators 400, and the driver brakes the vehicle through the hydraulic mechanism. - Even in such a case, the operation
amount command value 120 may of course be computed so that brake is applied to the vehicle from the remainingnormal actuators 400. - In the absence of the hydraulic backup mechanism, even when the vehicle cannot be braked by using the brake for any of two front or rear wheels or any of one front wheel and one rear wheel in diagonal relation, brake must be applied to the vehicle from the remaining
normal actuators 400. In this case, preferably, the engine revolution speed is controlled to reduce the vehicle speed so that the influence of the braking in an unbalanced state is suppressed. - Fig. 52 is a time chart showing the operations of the operation
amount generating node 100 and theactuator driving node 300 when theactuator driving node 300 or theactuator 400 for the rear left wheel is failed at the start timing of the brake control. The horizontal axis represents the lapse of time in a direction from the left to the right. - This time chart is premised on that the operation
amount generating node 100 selects the wheels, on which the braking force control is executed, by referring to the braked wheel selection table shown in Fig. 51A. - First, upon detecting the step-down of the brake pedal by the driver, the operation
amount generating node 100 sends a braking start notification to theactuator driving nodes 300 for the four wheels (2210). - Upon receiving the braking start notification, each of the
actuator driving nodes 300 executes self-diagnosis on its own failure and failure diagnosis on theactuator 400 with thefailure detecting function 210C (2220), and it sends the diagnosis result as a response message to the operation amount generating node 100 (2230). At this time, theactuator driving node 300 for the rear left wheel issues a response message to notify the operationamount generating node 100 of that a failure has been detected. Additionally, eachactuator driving node 300 receives the diagnosis results sent from the otheractuator driving nodes 300 via mutual communication. - The operation
amount generating node 100 receives the diagnosis results from theactuator driving nodes 300, detects the failure of theactuator driving node 300 for the rear left wheel, and selects the wheels such that the brake control is executed with the two front wheels (2240). - The operation
amount generating node 100 computes the target operation amounts for the two front wheels (2250). Further, thenode 100 sends the operation amount command values 120 to theactuator driving nodes 300 for the two front wheels, and also sends the operation amount command values 120 to theactuator driving nodes 300 for the two rear wheels in order to command release of the braking forces (2260). - Upon receiving the operation
amount command value 120, each of theactuator driving nodes 300 for the two front wheels updates a target value of the braking force control and executes the braking force control of theactuator 400. Also, upon receiving the operationamount command value 120, theactuator driving node 300 for the rear right wheel similarly updates a target value of the braking force control and executes the braking force control of theactuator 400. However, thatnode 300 does not actually generate the braking force because the received operationamount command value 120 has a value commanding release of the braking force. - On the other hand, the
actuator driving node 300 for the rear left wheel selects the control program (Z) as a result of detecting its own failure, and therefore does not produce the braking force (2270). - Fig. 53 is a time chart showing the operations of the operation
amount generating node 100 and theactuator driving node 300 when theactuator driving node 300 or theactuator 400 for the rear left wheel is failed during the brake control. The horizontal axis represents the lapse of time in a direction from the left to the right. - This time chart is premised on that the operation
amount generating node 100 selects the wheels, on which the braking force control is executed, by referring to the braked wheel selection table shown in Fig. 51A. - First, the operation
amount generating node 100 receives the response message from eachactuator driving node 300. By referring to the failure diagnosis result of eachactuator driving node 300, which is contained in the response message, the operationamount generating node 100 detects the occurrence of a failure in theactuator driving node 300 for the rear left wheel (2310), and selects the wheels such that the brake control is executed with the two front wheels (2320). - Then, the operation
amount generating node 100 computes the target operation amount for each of the wheels to be subjected to the brake control (2330). Further, thenode 100 sends the operation amount command values 120 to theactuator driving nodes 300 for the two front wheels, and also sends the operation amount command values 120 to theactuator driving nodes 300 for the two rear wheels in order command release of the braking forces (2340). - Upon receiving the operation
amount command value 120, each of theactuator driving nodes 300 for the two front wheels updates a target value of the braking force control and executes the braking force control of theactuator 400. Also, upon receiving the operationamount command value 120, theactuator driving node 300 for the rear right wheel similarly updates a target value of the braking force control and executes the braking force control of theactuator 400. However, thatnode 300 does not actually generate the braking force because the received operationamount command value 120 has a value commanding release of the braking force. - On the other hand, the
actuator driving node 300 for the rear left wheel selects the control program (Z) as a result of detecting its own failure, and therefore does not produce the braking force. - As described above with reference to Figs. 52 and 53, if any
actuator driving node 300 or the associatedactuator 400 is failed, the operationamount generating node 100 generates the operation amount command values 120 so that the vehicle is braked using the normalactuator driving nodes 300 for the two front or rear wheels. Even in that case, therefore, the vehicle can be avoided from being affected by the braking in an unbalanced state. - Fig. 54 is a time chart showing the operations of the operation
amount generating node 100 and theactuator driving node 300 when theactuator driving node 300 or theactuator 400 for the rear left wheel, which has been temporarily failed, is recovered to the normal state during the brake control. The horizontal axis represents the lapse of time in a direction from the left to the right. - This time chart is premised on that the operation
amount generating node 100 selects the wheels, on which the braking force control is executed, by referring to the braked wheel selection table shown in Fig. 51A. - Because the
actuator driving node 300 for the rear left wheel is failed, the operationamount generating node 100 selects the wheels such that the brake control is executed with the two front wheels. Then, thenode 100 sends the operation amount command values 120 to theactuator driving nodes 300 for the two front wheels, and also sends the operation amount command values 120 to theactuator driving nodes 300 for the two rear wheels in order to command release of the braking forces (2410). - Each of the
actuator driving nodes 300 executes self-diagnosis on its own failure and failure diagnosis on theactuator 400 with thefailure detecting function 210C, and it sends the diagnosis result as a response message to the operation amount generating node 100 (2420). At this time, when theactuator driving node 300 for the rear left wheel is recovered from the failed state, it switches over the control program from (Z) to (X), and maintains the braking force in the released state in accordance with the operationamount command value 120 to command release of the braking force. Also, thenode 300 sends a response message to notify the operationamount generating node 100 of that the failure has been eliminated. Additionally, eachactuator driving node 300 receives the diagnosis results sent from the otheractuator driving nodes 300 via mutual communication. - The operation
amount generating node 100 receives the diagnosis results from theactuator driving nodes 300, detects the restoration of theactuator driving node 300 for the rear left wheel from the failed state, and selects the wheels such that the brake control is executed with the four wheels (2430). - The operation
amount generating node 100 computes the target operation amounts for the four front wheels (2440), and sends the operation amount command values 120 to theactuator driving nodes 300 for the four wheels (2450). - Upon receiving the operation
amount command value 120, each of theactuator driving nodes 300 for the two front wheels updates a target value of the braking force control and executes the braking force control of theactuator 400. Also, upon receiving the new operationamount command value 120, theactuator driving node 300 for the rear right wheel updates a target value of the braking force control and executes the braking force control of theactuator 400. Similarly, upon receiving the new operationamount command value 120, theactuator driving node 300 for the rear left wheel updates a target value of the braking force control and executes the braking force control of theactuator 400. - As described above with reference to Fig. 54, even when the
actuator driving node 300 or theactuator 400 having been temporarily failed is recovered to the normal state, the vehicle can be recovered to the normal control state without causing the braking in an unbalanced state because the operationamount generating node 100 generates the operation amount command values 120 depending on whether theactuator driving nodes 300 or theactuator 400 is normal or abnormal. - Fig. 55 is a time chart showing the operation of the
actuator driving node 300 when the operationamount generating node 100 is failed during the brake control. The horizontal axis represents the lapse of time in a direction from the left to the right. - This time chart is premised on that the
actuator driving node 300 selects the control program based on the control program selection table shown in Fig. 47A. - Upon detecting a failure with the
failure detecting function 210B, the operationamount generating node 100 stops the transmission of the operationamount command value 120 and sends the failure detection notification 230 (2510). - Upon receiving the
failure detection notification 230, each of theactuator driving nodes 300 sends a response message and confirms the reception of thefailure detection notification 230 via mutual communication, thereby determining that the operationamount generating node 100 is abnormal (2520). - After determining that the operation
amount generating node 100 is abnormal, eachactuator driving node 300 switches over the control program from (X) to (Y) so that the braking force control is executed in accordance with the driver'sdemand signal 200. - As described above with reference to Fig. 55, if the operation
amount generating node 100 is failed, eachactuator driving node 300 confirms the occurrence of a failure in the operationamount generating node 100 via mutual communication, and all theactuator driving nodes 300 switch over the control program so as to brake the vehicle in accordance with the driver'sdemand signal 200. Even in that case, therefore, the brake control of the vehicle can be maintained. - Fig. 56 is a time chart showing the operation of the operation
amount generating node 100 and theactuator driving node 300 when the operationamount generating node 100, which has been temporarily failed, is recovered to the normal state during the brake control. The horizontal axis represents the lapse of time in a direction from the left to the right. - This time chart is premised on that the
actuator driving node 300 selects the control program based on the control program selection table shown in Fig. 47A. - Because the operation
amount generating node 100 is failed, each of theactuator driving nodes 300 executes the braking force control in accordance with the driver'sdemand signal 200 by using the control program (Y). - When the operation
amount generating node 100 is recovered from the failed state, it receives the response message from each actuator driving node 300 (2610). By referring to the failure diagnosis result of eachactuator driving node 300, which is contained in the response message, the operationamount generating node 100 confirms the presence or absence of an abnormality and the position of the abnormality in eachactuator driving node 300 and theactuator 400, and selects theactuator driving nodes 300 to be subjected to the brake control (2620). - Then, the operation
amount generating node 100 computes the target operation amount for each of the wheels to be subjected to the brake control (2630), and sends the operationamount command value 120 to the corresponding actuator driving node 300 (2640). At this time, the operationamount generating node 100 may send a failure recovery notification together to notify eachactuator driving node 300 of that the failure has been eliminated. - Upon receiving the operation
amount command value 120, eachactuator driving node 300 sends a response message and confirms the reception of the operationamount command value 120 via mutual communication, thereby determining that the operationamount generating node 100 is normal (2650). At this time, the reception of the failure recovery notification may be used to determine whether the operationamount generating node 100 is normal. - After determining that the operation
amount generating node 100 is normal, eachactuator driving node 300 switches over the control program from (Y) to (X) so that the braking force control is executed in accordance with the operationamount command value 120. - As described above with reference to Fig. 56, even when the operation
amount generating node 100 having been temporarily failed is recovered to the normal state, the vehicle can be recovered to the normal control state without causing the braking in an unbalanced state because eachactuator driving node 300 switches over the control program depending on whether the operationamount generating node 100 is normal or abnormal. - Fig. 57 is a time chart showing the operation of the
actuator driving node 300 when the operationamount generating node 100 and theactuator driving node 300 or theactuator 400 for the rear left wheel are failed during the brake control. The horizontal axis represents the lapse of time in a direction from the left to the right. - This time chart is premised on that the
actuator driving node 300 selects the control program based on the control program selection table shown in Fig. 47A. - Upon detecting a failure with the
failure detecting function 210B, the operationamount generating node 100 stops the transmission of the operationamount command value 120 and sends the failure detection notification 230 (2710). On the other hand, upon detecting a failure with thefailure detecting function 210C, theactuator driving node 300 for the rear left wheel switches over the control program from (X) to (Z). - Upon receiving the
failure detection notification 230, each of theactuator driving nodes 300 sends a response message and confirms the reception of thefailure detection notification 230 via mutual communication. At this time, the failedactuator driving node 300 for the rear left wheel issues the response message to notify the otheractuator driving nodes 300 of that the failure has been detected therein (2720) - Responsively, each of the other
actuator driving nodes 300 determines that the operationamount generating node 100 and theactuator driving node 300 for the rear left wheel are abnormal, and then selects the control program based on the control program selection table shown in Fig. 47A. - More specifically, the
actuator driving nodes 300 for the front left and right wheels switch over the control program from (X) to (Y) so that the braking force control is executed in accordance with the driver'sdemand signal 200. Theactuator driving node 300 for the rear right wheel switches over the control program from (X) to (Z) so that the braking force is released. - As described above with reference to Fig. 57, if the operation
amount generating node 100 and anyactuator driving node 300 are failed, eachactuator driving node 300 confirms the occurrence of a failure in the operationamount generating node 100 and anyactuator driving node 300 via mutual communication, and the normalactuator driving nodes 300 switch over the control program depending on the location of the failedactuator driving nodes 300 so as to execute the braking force control in accordance with the driver'sdemand signal 200 or command release of the braking force in a proper manner. Even in that case, therefore, the brake control of the vehicle can be maintained while avoiding the braking in an unbalanced state. - While the operations of the operation
amount generating node 100 and theactuator driving nodes 300 have been described above, by way of example, in connection with the braking, the present invention is similarly applied to the steering. - In the event of a failure in the
actuator driving node 300 or theactuator 400 for the steering angle control, theactuator driving node 300 for the steering angle control sends the failure detection notification to the operationamount generating node 100 and the otheractuator driving nodes 300. - Upon receiving the failure detection notification from the
actuator driving node 300 for the steering angle control, the operationamount generating node 100 operates as follows. When theactuator driving node 300 or theactuator 400 for the steering angle control is provided with redundancy, the operationamount generating node 100 can continue the steering control by sending the operationamount command value 120 to the normalactuator driving node 300 for the steering angle control. Alternatively, the operationamount generating node 100 can also continue the steering control by sending the operation amount command values 120 to theactuator driving nodes 300 for the brake control so that the vehicle is caused to turn due to a difference in braking force between the brakes for the right wheel and the left wheel. - On the other hand, in the event of a failure in the operation
amount generating node 100, the operationamount generating node 100 sends the failure detection notification to all theactuator driving nodes 300. Responsively, theactuator driving nodes 300 for the steering angle control can continue the steering control by taking in the driver'sdemand signal 200 from thesensor 500. - Also, in the event of a failure in the
actuator driving node 300 or theactuator 400 for the steering angle control, theactuator driving nodes 300 for the brake control detects the failure of theactuator driving node 300 for the steering angle control by receiving the failure detection notification from theactuator driving node 300 for the steering angle control or by confirming non-reception of a response message from it. Then, theactuator driving nodes 300 for the brake control can make the steering control continued while modifying the respective operation amounts via mutual reference using response messages in accordance with the driver'sdemand signal 200 from thesensor 500 so that the vehicle is caused to turn due to a difference in braking force between the brakes for the right wheel and the left wheel. - While the above description has been made of the vehicle control system including the operation
amount generating node 100 and theactuator driving nodes 300, the present invention is also effectively applicable to a vehicle control system in which the vehicle is controlled only with theactuator driving nodes 300 without using the operationamount generating node 100, as shown in Fig. 58. - Each of the
actuator driving nodes 300 used in the vehicle control system according to this modification controls an associatedactuator 400 by selecting the control program (Y) or (Z). This selection of the control program is executed in the same manner as the case where the operationamount generating node 100 is failed in the vehicle control systems according to the above-described embodiments. - Thus, since the
actuator driving nodes 300 operating independently of one another control theiractuators 400 under coordination among them, a safe vehicle control system can be realized even in the vehicle not equipped with the operationamount generating node 100. - A vehicle control system according to a ninth embodiment of the present invention will be described below with reference to Figs. 59 through 61.
- Fig. 59 shows a basic configuration of the vehicle control system according to the ninth embodiment. The vehicle control system comprises a
sensor 500 for detecting the driver's demand, anactuator 400, an operationamount generating node 100, andactuator driving nodes 300. - Of those components, the
sensor 500 for detecting the driver's demand, the operationamount generating node 100, and theactuator driving nodes 300 have thefailure detecting functions failure detecting function 210C of eachactuator driving node 300 has not only the self-diagnosis function, but also the function of detecting a failure of the associatedactuator 400. - The operation
amount generating node 100 computes an operationamount command value 120 based on a driver'sdemand signal 200 and avehicle status signal 201. Theactuator driving node 300 receives the operationamount command value 120 and controls theactuator 400 to thereby execute driving, steering, braking, etc. of the vehicle. - When each of the
failure detecting functions actuator 400, it outputs afailure detection notification 230 to the exterior of the node to notify that its own node is in the failed state. When the nodes provided with the failure detecting functions are in the failed state, each of all those nodes stops any other outputs to the exterior than outputting thefailure detection notification 230, namely, it is constituted to be fail-silent. - Further, each node includes a data reception table 9100. Though not shown in Fig. 59, each node includes a data transmission table as well. Data stored in the data transmission table is output to the other nodes at a period preset in the system. Conversely, data received from the other nodes is temporarily stored in the data reception table and is read for use at a control period in the relevant node.
- Instead of interconnecting the nodes via signal lines as shown in Fig. 59, the nodes may be interconnected via a bus or network configuration in which a common communication path is used in a time division manner. In this ninth embodiment, it is assumed that data outputted from one node can be received by a plurality of other nodes. Each of the
failure detecting functions - Fig. 60 shows a practical example of the data reception table 9100. The data reception table 9100 has a
message number field 9101 for identifying a transmission source and a transmission event. Themessage number field 9101 may be an actual field, or it may be given as a particular address assigned to the relevant message instead of the actual field. - Other fields of the data reception table 9100 include a
validity field 9102 indicating validity of the relevant message, a time-of-day field 9103 recording the time of day at which the relevant message has been transmitted, amessage data field 9104, and afailure vote field 9105. - The message outputted from each node contains those items of information and is stored in the data reception table divided into predetermined fields in the node that has received the message.
- The message unnecessary for the relevant node is not required to be stored in it. As indicated by the message number (No. 2) in Fig. 60, therefore, the validity field corresponding to such a message may be set invalid (0) from the beginning. Alternatively, though not necessary for control, the validity field corresponding to such a message may be set valid just for the purpose of signal monitoring. Of course, when the
failure detection notification 230 is received from any node, it is reflected on the data field to be able to make determination on whether the received detection notification is valid. - A method of diagnosing a failure of the other node will be described with reference to Fig. 61. While the following description is made of the case where the operation amount generating node is failed, it is similarly applied to the case where any other node is failed.
- First, the
message number field 9101 corresponding to the operation amount generating node is taken out (step S2110). In an example where the message number field is given as an address, this step is executed by accessing the relevant address. - Then, the
validity field 9102 of the data reception table 9100 is referred to. If thevalidity field 9102 indicates the data being valid and the time-of-day field 9103 is updated, control is executed using the data in themessage data field 9104 sent from the operation amount generating node. Here, whether the time-of-day field 9103 is updated or not is determined, for example, by checking whether the difference between the time-of-day information ("now") owned by the relevant node and the time-of-day field ("time") 9103 corresponding to each message is within a preset certain value ("limit")(step S2120). - Returning to Fig. 60, the time of day contained in the message corresponding to the
node 5 is older than the other nodes and has a difference not less than 50. Based on such a difference, it is determined that the operation amount generating node is not operated. If the relevant field is determined as being not valid with the above-mentioned method or another suitable one, this means that the operation amount generating node does not operate normally. Therefore, control is executed using the information sent from the other nodes (step S2140). On the other hand, if the relevant field is determined as being valid with the above-mentioned method or another suitable one, control is executed using the information sent from the operation amount generating node (step S2130). - Then, a failure vote is outputted to notify the determination result to the other nodes (step S2150). This failure vote is stored in the
failure vote field 9105. Each numeral in thefailure vote field 9105 of the data reception table 9100 is expressed as a binary number and corresponds to each of the message numbers assigned in increasing order starting from the left end. In an example of Fig. 60, all the valid nodes except for thenode 5 determine that thenode 5 is failed ("vote" = 1). - Although only the
node 5 outputs a failure vote indicating that it is normal ("vote" = 0), thenode 5 is determined to be invalid based on a predetermined algorithm, e.g., majority decision, and the validity field is made invalid (steps S2160 and S2170). - When the node having failed to operate is recovered, the recovery can be realized, for example, with elimination of a trouble or automatic resetting. In such a case, too, whether the relevant node has recovered or not is decided with voting made from the other nodes based on the observation results.
- Thus, since all the nodes taking part in the control can accept the
node 5 at the same time, it is possible to avoid a situation where the control method differs for each of individual system sections. - Additionally, the voting algorithm used in determining the recovery of the failed node may be selected as a different one from the algorithm used in determining the occurrence of a failure. For example, the recovery may be determined based on unanimous voting of all the nodes. Further, even the actuator node is also constituted to output a vote so that the system state can be shared by all the nodes via failure voting.
- The ninth embodiment is not limited to the above-described example, and it can be practiced in various forms. For example, the command controller for generating control commands is not always required to be a single integrated one, and it may be constituted by a plurality of command controllers.
- As shown in Fig. 62, a system may comprise a sensor controller 3000-1 for taking in information from a steering wheel angle sensor 3002-2 and outputting steering wheel angle information D3000 to a network, a sensor controller 3001-1 for taking in information from a brake pedal position sensor 3001-2 and outputting brake pedal step-down amount information D3001 to the network, an actuator controller 3002-1 for operating a steering angle control motor 3002-2, an actuator controller 3003-1 for operating an electric brake caliper, a command controller A (3010-1), and a command controller B (3010-2), which are interconnected via an in-vehicle network N3000.
- With such a configuration, the command controller 3010-2 for computing a target braking force D3010-2 and the command controller 3010-1 for computing a target steering angle D3010-1 are arranged in physically spaced relation, whereby a probability of total loss of the integrated control function can be reduced.
- The vehicle control system of the present invention has advantages as follows:
- (1) Even when a vehicle motion integrated control unit is in an unusable state, a steering unit operated by the driver and a vehicle control unit are able to communicate with each other, whereby the vehicle control can be executed as per the driver's intent.
- (2) In the vehicle control system, if a failure occurs in any node, each of the other normal nodes switches over a control mode in accordance with a failure detection notification sent from the failed node so that an error can be backed up through coordination in the entire system. Therefore, a sufficiently high-reliable vehicle control system can be realized at a low cost without increasing redundancy of each node beyond the least necessary level.
- (3) Since the operation amount applied from the driver is corrected with the correction amount generated by the correction amount generating node, appropriate steering and braking operations are resulted, whereby stability of the vehicle can be improved.
- (4) If the correction amount generating node is failed, the control function is contracted such that the vehicle motion can be provided as per the operation by the driver without using the correction amount.
- (5) While a high level of information processing is required to generate the correction amount, comparatively simple information processing is required to generate the operation amount. This makes it essential in the correction amount generating node to increase the number of parts, to raise the operation frequency, and to operate with less electrical and thermal allowances as compared with the operation amount generating node. As a result, the correction amount generating node has a higher failure rate than the operation amount generating node. Thus, the advantage of the present invention is particularly valuable in point of avoiding the influence of a failure of the correction amount generating node having a higher failure rate.
- (6) Even if the operation amount generating node is failed, the actuator driving nodes detect the failure of the operation amount generating node and switch over the control programs so as to continue the vehicle control, whereby the correction amount generating node is not required to have redundancy and a safe vehicle control system can be realized at a low cost.
- (7) Since the actuator driving nodes detect the occurrence of a failure via mutual communication and switch over the control programs to proper ones, it is possible to avoid a risky vehicle motion, such as braking in an unbalanced state. Further, even in the failed state of the operation amount generating node, safe vehicle control can be maintained.
Claims (55)
- A vehicle control system comprising:a sensor controller (2) for taking in sensor signals indicating a status variable of a vehicle (50) and an operation amount applied from a driver;a command controller (1) for generating a control target value based on the sensor signals taken in by said sensor controller (2); andan actuator controller (3) for receiving the control target value from said command controller (1) and operating an actuator (5) to control the vehicle (50), said sensor controller (2), said command controller (1) and said actuator controller (3) being interconnected via a network (N1),wherein said actuator controller (3) includes control target value generating means (3B) for generating a control target value based on the sensor signals taken in by said sensor controller (2) and received by said actuator controller (3) via the network (N1) when the control target value generated by said command controller (1) is abnormal, and controls said actuator (5) in accordance with the control target value generated by said control target value generating means (3B).
- The vehicle control system according to Claim 1, wherein said sensor controller (2) operates as deceleration instruction means (32), acceleration instruction means (33), and steering angle instruction means (31), said actuator controller (3) operates as braking force control means (12), driving force control means (13), and steering angle control means (11), and said command controller (1) operates as vehicle motion integrated control means (10) for controlling a vehicle motion status, and
wherein when said command controller (1) is abnormal, said braking force control means (12) controls a braking force in accordance with an operation amount applied through said deceleration instruction means (32), said driving force control means (13) controls a driving force in accordance with an operation amount applied through said acceleration instruction means (33), and said steering angle control means (11) controls a steering angle in accordance with an operation amount applied through said steering angle instruction means (31). - The vehicle control system according to Claim 1 or 2, wherein said command controller (1) is constituted as vehicle motion integrated control means (10) comprising:vehicle status estimating means (101) for estimating a vehicle motion status;target status computing means (102) for computing a target motion status to be taken by the vehicle (50);operation amount computing means (103) for computing an operation force and moment to be generated on the vehicle (50) based on the estimated vehicle motion status and the computed target motion status; andoperation amount computing means (104) for computing respective control target values for said braking force control means (12), said driving force control means (13), and said steering angle control means (11) based on the computed operation force and moment.
- The vehicle control system according to Claim 3, wherein the vehicle motion status and the target motion status are each represented by a status variable in a motion of the vehicle (50) as a rigid body.
- The vehicle control system according to Claim 3 or 4, wherein said vehicle status estimating means (101) estimates and manages a motion status on a local coordinate system fixed to the vehicle (50), a motion status on a coordinate system fixed to a particular point, surrounding environment under which the vehicle (50) is running, and a failed state of the control means installed in the vehicle (50) .
- The vehicle control system according to at least one of Claims 3 to 5, wherein said target status computing means (102) computes a driver's intent in maneuvering the vehicle (50) based on respective operation amounts applied through said deceleration instruction means (32), said acceleration instruction means (33), and said steering angle instruction means (31), as well as on the vehicle motion status, computes a limit motion status allowable for the vehicle (50) based on dynamic constants of the vehicle (50), specifications of the control means installed in the vehicle (50), and the failed state of the control means installed in the vehicle (50), and computes the target motion status based on the vehicle motion status, the driver's intent in maneuvering the vehicle (50), and the limit motion status.
- The vehicle control system according to at least one of Claims 3 to 6, wherein said operation amount computing means (103) computes the operation force and moment on the local coordinate system fixed to the vehicle (50).
- The vehicle control system according to at least one of Claims 3 to 7, wherein said operation amount computing means comprises tire vector computing means for computing a tire force vector to be generated per tire based on the computed operation force and moment, and an operation amount allocating section for computing respective control target values for said braking force control means (12), said driving force control means (13), and said steering angle control means (11) based on the computed tire force vectors.
- The vehicle control system according to Claim 8, wherein said tire vector computing means computes the tire force vector on the local coordinate system fixed to the vehicle (50).
- The vehicle control system according to Claim 8 or 9, wherein said operation amount allocating section is prepared corresponding to configurations of said braking force control means (12), said driving force control means (13), and said steering angle control means (11), which are installed in the vehicle (50).
- The vehicle control system according to at least one of Claims 2 to 10, further comprising driving force control means (13) including at least one driving force generator shared by a plurality of driving wheels (72, 75),
wherein said driving force control means (13) executes control to receive per driving wheel (72, 75), from said vehicle motion integrated control means (10), a driving force to be generated for each of said driving wheels (72, 75), and to regulate at least two of an engine, a transmission and an electric motor in an integrated manner, thereby generating the driving force on each of said driving wheels (72, 75). - A vehicle control system comprising an operation amount generating node (100) for computing an operation amount command value based on driver's demand signals (200) and vehicle status signals (201) from sensors (500, 550), and actuator driving nodes (300) each controlling an actuator (400) in accordance with the operation amount command value from said operation amount generating node (100), thereby driving, steering and braking a vehicle (50),
wherein each of said nodes (100, 300) has a failure detecting function (210B, 210C) and operates such that, when a failure is detected in itself with the failure detecting function (210B, 210C), the relevant node (100, 300) does not make any action externally of the relevant node (100, 300) except for notifying that the relevant node (100, 300) is in a failed state, and when a failure occurs in any node (100, 300), the other normal nodes (100, 300) than the failed node (100, 300) switch over control in accordance with a failure detecting notification from the failed node, thereby continuing normal operation as an entire system. - The vehicle control system according to Claim 12, wherein each of said driver's demand detecting sensors (500) is connected to a communication network (N1), and when a failure of the relevant sensor (500) is detected, the relevant sensor (500) does not make any action externally of the relevant sensor (500) except for notifying that the relevant sensor (500) is in a failed state.
- The vehicle control system according to Claim 12 or 13, wherein said driver's demand detecting sensors (500), said operation amount generating node (100), and said actuator driving node (300) are connected to the same communication network (N1).
- The vehicle control system according to Claim 13 or 14, wherein when said operation amount generating node (100) receives the failure detection notification from the failed node, said operation amount generating node (100) switches over control depending on a failure position so that a vehicle running state is kept stable.
- The vehicle control system according to Claim 14 or 15, wherein each of said actuator driving nodes (300) has a function of generating an operation amount command value based on the signals from said driver's demand detecting sensors (500) when the operation amount command value is not receivable from said operation amount generating node (100), and said operation amount generating node (100) switches over control from a normal mode to a mode for realizing the operation amount command value generating function so that the vehicle running state is kept stable, when the operation amount command value is not receivable from said operation amount generating node (100).
- The vehicle control system according to at least one of Claims 14 to 16, wherein said communication network (N1) is installed plural with redundancy.
- The vehicle control system according to Claim 17, wherein said communication network (N1) comprises a main bus (N1A) and a backup bus (N1B), said main bus (N1A) being connected to all of said driver's demand detecting sensors (500), said operation amount generating node (100) and said actuator driving nodes (300), said backup bus (N1B) being connected to a part of said driver's demand detecting sensors (500) and a part of said actuator driving nodes (300), and wherein, in the event of a failure of said main bus (N1A), each of said actuator driving nodes (300) generates an operation amount command value based on the sensor signals so that a vehicle running state is kept stable.
- The vehicle control system according to at least one of Claims 13 to 18, wherein each of said sensors (500, 550) comprises a plurality of sensor elements (60A, 60B), A/D converters (61A, 61B) for converting outputs of said plurality of sensor elements (60A, 60B) to digital values, a match checking function (62) for a plurality of A/D-converted values, a filter function (63), and a communication interface (64, 65).
- The vehicle control system according to at least one of Claims 14 to 19, wherein said driver's demand detecting sensors (500) include a steering angle sensor (41) for measuring a steering wheel rotational angle, a brake pedal position sensor (42) for measuring a brake pedal step-down amount, and an accelerator pedal position sensor (43) for measuring an accelerator pedal step-down amount;
said operation amount generating node (100) is constituted as a vehicle motion integrated controller (10) and a driving-system integrated controller, said vehicle motion integrated controller (10) interpreting a driver's intent based on the signals from said driver's demand detecting sensors (500) and controlling a vehicle motion in an integrated manner in combination with the signals from said vehicle status detecting sensors (550), said driving-system integrated controller interpreting a driver's intent based on the signals from said driver's demand detecting sensors (500) and controlling a driving system of the vehicle (50) in an integrated manner in combination with the signals from said vehicle status detecting sensors (550); and
said actuator driving nodes (300) are constituted as a steering actuator driving controller for controlling a steering actuator which generates a steering force, a brake actuator driving controller for controlling a brake actuator which generates a braking force, and a suspension actuator driving controller for controlling a suspension actuator which adjusts a damping force,
said nodes (100, 300) being connected to the same communication network (N1). - The vehicle control system according to Claim 20, wherein a radar or a camera (44) for detecting a situation outside the vehicle is connected to said communication network (N1).
- The vehicle control system according to Claim 20 or 21, wherein said accelerator pedal position sensor (43) is connected to said communication network (N1) and is further connected to an engine controller for receiving a torque command value from said driving-system integrated controller and controlling an engine in accordance with the received torque command value.
- The vehicle control system according to Claim 20, 21 or 22, wherein when a brake pedal (52) and a braking force generating mechanism are not coupled mechanically to each other, at least said brake pedal position sensor (42) is constituted to enable normal operation to be continued even in the occurrence of a single failure.
- The vehicle control system according to at least one of Claims 20 to 23, wherein when a steering wheel (51) and a steering force generating mechanism are not coupled mechanically to each other, said steering angle sensor (41) and said steering actuator driving controller are constituted to enable normal operation to be continued even in the occurrence of a single failure, and said steering actuator is installed plural with redundancy.
- The vehicle control system according to Claim 24, wherein a force generated by each of said plurality of steering actuators is smaller than a force generated by said steering actuator when said steering wheel (51) and said steering force generating mechanism are mechanically coupled to each other.
- The vehicle control system according to Claim 24, wherein said steering actuator driving controller comprises a plurality of driving nodes (300) with redundancy each constituted such that, when a failure in the relevant node (300) is detected, the relevant node (300) does not make any action externally of the relevant node (300) except for notifying that the relevant node (300) is in a failed state, and wherein said driving nodes (300) drive said steering actuators in redundant arrangement independently of one another.
- The vehicle control system according to at least one of Claims 23 to 26, wherein each of said brake pedal position sensor (42) and said steering angle sensor (41) is constituted with redundancy and comprises a plurality of sensor elements (60A, 60B), A/D converters (61A, 61B) for converting outputs of said plurality of sensor elements (60A, 60B) to digital values, a match checking function (62) for a plurality of A/D-converted values, a filter function (63), and a communication interface (64, 65).
- The vehicle control system according to at least one of Claims 23 to 27, wherein each of said brake pedal position sensor (42) and said steering angle sensor (41) comprises at least three sensor elements (60A, 60B), A/D converters (61A, 61B) for converting outputs of said plurality of sensor elements (60A, 60B) to digital values, a majority decision function for a plurality of A/D-converted values, a filter function (63), and a communication interface (64, 65).
- A vehicle control system comprising an operation amount generating node (610) for generating an operation amount, a correction amount generating node (620) for generating a correction amount, and an actuator driving node (630) for driving an actuator (640),
wherein said actuator driving node (630) controls said actuator (640) by using, as a control target value, a value obtained by adding the correction amount from said correction amount generating node (620) to the operation amount from said operation amount generating node (610) when said correction amount generating node (620) is normal, and controls said actuator (640) by using, as the control target value, the operation amount from said operation amount generating node (610) when said correction amount generating node (620) is abnormal. - A vehicle control system comprising an operation amount generating node (610) for generating an operation amount, a correction amount generating node (620) for generating a correction amount, and an actuator driving node (630) for driving an actuator (640),
wherein said actuator driving node (630) controls said actuator (640) by using, as a control target value, a value obtained by adding the correction amount generated from said correction amount generating node (620) to the operation amount from said operation amount generating node (610) when said correction amount generating node is normal, and controls said actuator (640) by using, as the control target value, a value obtained by adding, to the operation amount from said operation amount generating node (610), a value resulting from multiplying the correction amount prior to the occurrence of an abnormality by a coefficient when said correction amount generating node (620) is abnormal. - The vehicle control system according to Claim 30, wherein said coefficient is reduced at a predetermined time constant with the lapse of time from a point in time at which an abnormality has occurred in said correction amount generating node (620).
- The vehicle control system according to at least one of Claims 29 to 31, wherein said operation amount generating node (610) generates the operation amount based on an angle by which a steering column is operated, and said actuator driving node (630) drives a steering mechanism.
- The vehicle control system according to at least one of Claims 29 to 32, wherein said operation amount generating node (610) generates the operation amount based on an angle or a stepping-down force by which a brake pedal (616) is operated, and said actuator driving node (630) drives a brake provided on a wheel.
- The vehicle control system according to at least one of Claims 29 to 33, wherein said correction amount generating node (620) is connected to an acceleration sensor or a yaw rate sensor (625) and generates the correction amount based on an output of said acceleration sensor or said yaw rate sensor (625).
- The vehicle control system according to at least one of Claims 29 to 34, wherein said correction amount generating node (620) is connected to an acceleration sensor or a yaw rate sensor (625) and generates the correction amount based on an output of said acceleration sensor or said yaw rate sensor (625) and the operation amount generated by said operation amount generating node (610).
- The vehicle control system according to at least one of Claims 29 to 35, wherein said correction amount generating node (620) is a node having higher processing performance than said operation amount generating node (610).
- The vehicle control system according to at least one of Claims 29 to 36, wherein said correction amount generating node (620) is a node having a higher operation frequency than said operation amount generating node (610).
- The vehicle control system according to at least one of Claims 29 to 37, wherein said operation amount generating node (610) is a node having a lower failure rate than said correction amount generating node (620).
- The vehicle control system according to at least one of Claims 29 to 38, wherein said correction amount generating node (620) has a failure detecting function.
- A vehicle control system comprising a plurality of actuator driving means (300) for controlling actuators (400) in accordance with a driver's demand and a vehicle status, and communication means for interconnecting said plurality of actuator driving means (300), thereby controlling at least one of driving, steering and braking of a vehicle (50),
wherein each of said actuator driving means (300) has control method selecting means (220) for selecting an actuator control method based on an operation state of itself and operation states of the other actuator driving means (300). - The vehicle control system according to Claim 40, wherein each of said actuator driving means (300) has failure detecting means (210C) for detecting its own failure and notifying the occurrence of the failure to the other actuator driving means (300) via said communication means, and selects the actuator control method based on the failed state of itself and the failed states of the other actuator driving means (300).
- A vehicle control system comprising a plurality of actuator driving means (300) for controlling actuators (400) in accordance with a driver's demand and a vehicle status, and communication means (600) for interconnecting said plurality of actuator driving means (300), thereby controlling at least one of driving, steering and braking of a vehicle (50),
wherein each of said actuator driving means (300) has control method selecting means (220) for selecting an actuator control method based on reception states of messages sent from the other actuator driving means (300) via said communication means (600). - The vehicle control system according to Claim 42, wherein each of said actuator driving means (300) sends a message notifying its own operation state to the other actuator driving means (300) via said communication means (600), and selects the actuator control method based on whether the messages have been received from the other actuator driving means (300).
- A vehicle control system comprising at least one operation amount generating means (100) for computing operation amount command values based on a driver's demand and a vehicle status, a plurality of actuator driving means (300) for controlling actuators (400) in accordance with the operation amount command values from said operation amount generating means (100), and communication means (600) for interconnecting said operation amount generating means (100) and said plurality of actuator driving means (300), thereby controlling at least one of driving, steering and braking of a vehicle,
wherein each of said actuator driving means (300) has control method selecting means (220) for selecting an actuator control method based on an operation state of itself, operation states of the other actuator driving means (300), and an operation state of said operation amount generating means (100). - The vehicle control system according to Claim 44, wherein said operation amount generating means (100) has failure detecting means (210B) for detecting its own failure and notifying the occurrence of the failure to said actuator driving means (300) or said operation amount generating means (100) via said communication means (600); and
each of said actuator driving means (300) has failure detecting means (210C) for detecting its own failure and notifying the occurrence of the failure to the other actuator driving means (300) or said operation amount generating means (100) via said communication means (600), and selects the actuator control method based on the failed state of itself, the failed states of the other actuator driving means (300), and the failed state of said operation amount generating means (100). - A vehicle control system comprising at least one operation amount generating means (100) for computing operation amount command values based on a driver's demand and a vehicle status, a plurality of actuator driving means (300) for controlling actuators (400) in accordance with the operation amount command values from said operation amount generating means (100), and communication means (600) for interconnecting said operation amount generating means (100) and said plurality of actuator driving means (300), thereby controlling at least one of driving, steering and braking of a vehicle,
wherein each of said actuator driving means (300) has control method selecting means (220) for selecting an actuator control method based on reception states of messages sent from the other actuator driving means (300) or said operation amount generating means (100). - The vehicle control system according to Claim 46, wherein said operation amount generating means (100) sends the operation amount command values to said actuator driving means (300) via said communication means (600); and
each of said actuator driving means (300) sends, upon receiving the operation amount command value, a response message to said operation amount generating means (100) or the other actuator diving means (300) via said communication means (600), and selects the actuator control method based on whether the operation amount command value from said operation amount generating means (100) or the response messages from the other actuator driving means (300) have been received. - A vehicle control system comprising sensor means (500, 550) for detecting a driver's demand and a vehicle status, at least one operation amount generating means (100) for computing operation amount command values based on information from said sensor means (500, 550), a plurality of actuator driving means (300) for controlling actuators (400) in accordance with the operation amount command values from said operation amount generating means (100) or the information from said sensor means (500, 550), and communication means (600) for interconnecting said sensor means (500, 550), said operation amount generating means (100) and said plurality of actuator driving means (300), thereby controlling at least one of driving, steering and braking of a vehicle,
wherein each of said actuator driving means (300) has control method selecting means (220) for selecting one of a control method using the operation amount command value from said operation amount generating means (100), a control method using the information from said sensor means (500, 550), and a control method of bringing said actuator (400) into a predetermined state based on an operation state of itself, operation states of the other actuator driving means (300), and an operation state of said operation amount generating means (100). - The vehicle control system according to Claim 48, wherein said operation amount generating means (100) has failure detecting means (210B) for detecting its own failure and notifying the occurrence of the failure to said actuator driving means (300) or said operation amount generating means (100) via said communication means (600); and
each of said actuator driving means (300) has failure detecting means (210C) for detecting its own failure and notifying the occurrence of the failure to the other actuator driving means (300) or said operation amount generating means (100) via said communication means (600), and selects one of a control method using the operation amount command value from said operation amount generating means (100), a control method using the information from said sensor means (500, 550), and a control method of bringing said actuator (400) into a predetermined state based on the failed state of itself, the failed states of the other actuator driving means (300), and the failed state of said operation amount generating means (100). - A vehicle control system comprising sensor means (500, 550) for detecting a driver's demand and a vehicle status, at least one operation amount generating means (100) for computing operation amount command values based on information from said sensor means (500, 550), a plurality of actuator driving means (300) for controlling actuators (400) in accordance with the operation amount command values from said operation amount generating means (100) or the information from said sensor means (500, 550), and communication means (600) for interconnecting said sensor means (500, 550), said operation amount generating means (100) and said plurality of actuator driving means (300), thereby controlling at least one of driving, steering and braking of a vehicle,
wherein each of said actuator driving means (300) has control method selecting means (220) for selecting one of a control method using the operation amount command value from said operation amount generating means (100), a control method using the information from said sensor means (500, 550), and a control method of bringing said actuator (400) into a predetermined state based on reception states of messages sent from the other actuator driving means (300) or said operation amount generating means (100). - The vehicle control system according to Claim 50, wherein said operation amount generating means (100) sends the operation amount command values to said actuator driving means (300) via said communication means (600); and
each of said actuator driving means (300) sends, upon receiving the operation amount command value, a response message to said operation amount generating means (100) or the other actuator driving means (300) via said communication means (600), and selects one of a control method using the operation amount command value from said operation amount generating means (100), a control method using the information from said sensor means (500, 550), and a control method of bringing said actuator (400) into a predetermined state based on whether the operation amount command value from said operation amount generating means (100) or the response messages from the other actuator driving means (300) have been received. - A vehicle control system for driving, steering and braking a vehicle, said vehicle control system comprising:a node (500) for detecting a driver's demand and outputting a corresponding signal;an operation amount generating node (100) for computing an operation amount command value based on the driver's demand signal and outputting a corresponding signal; andan actuator driving node (300) for controlling an actuator (400) in accordance with the operation amount command value from said operation amount generating node (100), said three nodes being arranged in a decentralized manner,wherein each of said three nodes includes a data reception table (9100) storing the signals outputted from the other nodes and has a function of detecting a failure of the other nodes by determining data stored in said data reception table (9100).
- The vehicle control system according to Claim 52, wherein said data reception table (9100) includes information representing the time of each message, and each node has a function of determining that a message transmission source or a communication path does not operate normally or has recovered to a normal state, when a time delay is larger than a predetermined value.
- The vehicle control system according to Claim 52 or 53, wherein said data reception table (9100) includes a failure vote section, and each node has a function of identifying a failed node or a node having recovered to a normal state in accordance with a predetermined algorithm.
- The vehicle control system according to Claim 54, wherein each node outputs, as failure votes, failure diagnosis information of the other nodes so that failure determination results of the individual nodes are shared by all the nodes.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP10150630.1A EP2177413B1 (en) | 2004-07-15 | 2005-03-31 | Vehicle control system |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2004207997 | 2004-07-15 | ||
JP2005021656A JP4478037B2 (en) | 2004-01-30 | 2005-01-28 | Vehicle control device |
Related Child Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP10150630.1A Division EP2177413B1 (en) | 2004-07-15 | 2005-03-31 | Vehicle control system |
EP10150630.1 Division-Into | 2010-01-13 |
Publications (3)
Publication Number | Publication Date |
---|---|
EP1616746A2 true EP1616746A2 (en) | 2006-01-18 |
EP1616746A3 EP1616746A3 (en) | 2008-01-23 |
EP1616746B1 EP1616746B1 (en) | 2010-02-24 |
Family
ID=34993200
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP05007078A Active EP1616746B1 (en) | 2004-07-15 | 2005-03-31 | Vehicle control system |
EP10150630.1A Active EP2177413B1 (en) | 2004-07-15 | 2005-03-31 | Vehicle control system |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP10150630.1A Active EP2177413B1 (en) | 2004-07-15 | 2005-03-31 | Vehicle control system |
Country Status (3)
Country | Link |
---|---|
US (4) | US7630807B2 (en) |
EP (2) | EP1616746B1 (en) |
DE (1) | DE602005019499D1 (en) |
Cited By (27)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1850229A1 (en) * | 2006-04-28 | 2007-10-31 | Marquardt GmbH | Device and method for controlling a functional unit in a vehicle |
FR2941547A1 (en) * | 2009-01-28 | 2010-07-30 | Peugeot Citroen Automobiles Sa | Logic controller for e.g. fans, in engine of motor vehicle, has corrector module generating corrected signal if properties of control signal are not satisfied, where corrected signal is applied on actuator if properties are not satisfied |
FR2972168A1 (en) * | 2011-03-02 | 2012-09-07 | Akka Ingenierie Produit | Decoupled steering control system i.e. steer-by-wire type control system, for controlling steering of wheels in e.g. front axle in car, has determination unit determining average maximum steering angle to be applied on wheels |
WO2013013928A1 (en) * | 2011-07-22 | 2013-01-31 | Continental Automotive Gmbh | Steering system for a motor vehicle |
EP2372247A3 (en) * | 2010-03-30 | 2014-03-12 | Azbil Corporation | Combustion controlling device |
WO2014079440A1 (en) * | 2012-11-20 | 2014-05-30 | Conti Temic Microelectronic Gmbh | Method for a driver assistance application |
EP2808454A3 (en) * | 2013-05-30 | 2015-08-26 | Sinfonia Technology Co., Ltd. | Motor controller for construction machines |
WO2015124379A1 (en) * | 2014-02-18 | 2015-08-27 | Jaguar Land Rover Limited | Control system and method |
WO2015185258A1 (en) * | 2014-06-03 | 2015-12-10 | Robert Bosch Gmbh | Method and device for monitoring a system of a vehicle that provides an at least partially automated driving function |
EP3150452A1 (en) * | 2015-10-01 | 2017-04-05 | Peugeot Citroën Automobiles SA | Test of a function for controlling the trajectory of a vehicle using the brakes without controlling the steering wheel |
EP3150451A1 (en) * | 2015-10-01 | 2017-04-05 | Peugeot Citroën Automobiles SA | Method for controlling the trajectory of a vehicle using the brakes, without controlling the steering wheel |
EP2583879A4 (en) * | 2010-06-18 | 2018-06-27 | Hitachi Automotive Systems, Ltd. | Electronic control device |
WO2018193449A1 (en) * | 2017-04-17 | 2018-10-25 | Mobileye Vision Technologies Ltd. | Secure system that includes driving related systems |
CN108859861A (en) * | 2017-05-11 | 2018-11-23 | 杭州长江汽车有限公司 | A kind of control system of electric vehicle, control method and electric vehicle |
SE1751567A1 (en) * | 2017-12-18 | 2019-06-19 | Komatsu Forest Ab | Work machine and method for monitoring a control system at a work machine |
EP2587330B1 (en) | 2011-10-27 | 2019-07-31 | Diehl Defence GmbH & Co. KG | Control device for at least partially autonomous operation of a vehicle and vehicle with such a control device |
WO2020219111A1 (en) | 2019-04-25 | 2020-10-29 | United Technologies Corporation | Control systems for hybrid electric powerplants |
EP3786021A4 (en) * | 2018-04-25 | 2021-06-30 | Denso Corporation | Vehicle control device |
KR20210082405A (en) * | 2013-07-19 | 2021-07-05 | 현대모비스 주식회사 | Method and apparatus for processing radar signal of vehicle |
CN114174123A (en) * | 2019-07-30 | 2022-03-11 | 马自达汽车株式会社 | Vehicle control system |
EP4019348A1 (en) * | 2020-12-28 | 2022-06-29 | Hitachi Astemo Netherlands B.V. | Brake system and method for braking a vehicle |
WO2022136597A1 (en) * | 2020-12-23 | 2022-06-30 | Haldex Vie (Shanghai) Electromechanical Brake System Co., Ltd. | A control method for automatic holding, a vehicle's brake system and a brake control module thereof |
WO2022136590A1 (en) * | 2020-12-23 | 2022-06-30 | Haldex Vie (Shanghai) Electromechanical Brake System Co., Ltd. | A vehicle's brake system and a method for braking a vehicle |
RU2776166C2 (en) * | 2017-12-18 | 2022-07-14 | Комацу Форест Аб | Working machine and method for monitoring control system on working machine |
EP4032784A1 (en) * | 2021-01-22 | 2022-07-27 | Transdev Group Innovation | Control device capable of controlling an angle of locking of an autonomous motor vehicle and autonomous motor vehicle comprising such a device |
US20230040044A1 (en) * | 2020-04-20 | 2023-02-09 | Thyssenkrupp Presta Ag | Degradation concept for a steer-by-wire steering system |
EP4169807A1 (en) * | 2021-10-21 | 2023-04-26 | Jtekt Corporation | Steer-by-wire steering system |
Families Citing this family (222)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7260369B2 (en) | 2005-08-03 | 2007-08-21 | Kamilo Feher | Location finder, tracker, communication and remote control system |
US7350879B2 (en) * | 2003-09-29 | 2008-04-01 | Haldex Brake Products Ab | Control network for brake system |
DE602005019499D1 (en) | 2004-07-15 | 2010-04-08 | Hitachi Ltd | Vehicle control system |
JP4137041B2 (en) * | 2004-10-18 | 2008-08-20 | トヨタ自動車株式会社 | Vehicle control device |
EP1672505A3 (en) * | 2004-12-20 | 2012-07-04 | BWI Company Limited S.A. | Fail-silent node architecture |
DE102005003916B4 (en) * | 2005-01-27 | 2012-06-06 | Continental Automotive Gmbh | Monitoring the functional safety of an internal combustion engine |
US20060253726A1 (en) * | 2005-05-06 | 2006-11-09 | Vikas Kukshya | Fault-tolerant architecture for a distributed control system |
FR2887839B1 (en) * | 2005-07-04 | 2007-09-14 | Conception & Dev Michelin Sa | STEERING SYSTEM OF A VEHICLE COMPRISING A DEGRADED OPERATING MODE IN THE EVENT OF A FAULT IN A WHEEL ROTATING ACTUATOR. |
DE102005038183A1 (en) * | 2005-08-12 | 2007-02-15 | Daimlerchrysler Ag | Method for operating a network |
JP4207966B2 (en) * | 2005-08-25 | 2009-01-14 | トヨタ自動車株式会社 | POWER OUTPUT DEVICE, ITS CONTROL METHOD, AND VEHICLE |
US8180525B2 (en) * | 2005-12-23 | 2012-05-15 | Continental Teves Ag & Co. Ohg | Method and system for assisting a driver when parking or maneuvering a motor vehicle |
US7953521B2 (en) * | 2005-12-30 | 2011-05-31 | Microsoft Corporation | Learning controller for vehicle control |
JP2007252153A (en) * | 2006-03-20 | 2007-09-27 | Hitachi Ltd | Automobile controller and automobile |
JP4645519B2 (en) * | 2006-04-27 | 2011-03-09 | 株式会社デンソー | Arithmetic processing device, control device and program |
CA2651252A1 (en) * | 2006-05-09 | 2008-05-08 | Lockheed Martin Corporation | Mobility traction control system and method |
JP2008002832A (en) * | 2006-06-20 | 2008-01-10 | Denso Corp | On-board navigation system |
DE102006031580A1 (en) | 2006-07-03 | 2008-01-17 | Faro Technologies, Inc., Lake Mary | Method and device for the three-dimensional detection of a spatial area |
EP2047641A1 (en) * | 2006-07-19 | 2009-04-15 | Nxp B.V. | Distributed communication system and corresponding communication method |
JP5052084B2 (en) * | 2006-09-19 | 2012-10-17 | Ntn株式会社 | Axle unit with in-wheel motor built-in sensor |
US8392882B2 (en) | 2006-11-30 | 2013-03-05 | Caterpillar Inc. | Engine state-based control of software functions |
US20080298256A1 (en) * | 2007-05-30 | 2008-12-04 | Hitachi, Ltd. | Distributed System |
JP5114123B2 (en) * | 2007-07-24 | 2013-01-09 | トヨタ自動車株式会社 | In-vehicle device control system |
DE102007036261A1 (en) * | 2007-08-02 | 2009-02-19 | Robert Bosch Gmbh | A braking system for a vehicle and method for operating a braking system for a vehicle |
JP4512621B2 (en) * | 2007-08-06 | 2010-07-28 | 株式会社日立製作所 | Distributed system |
JP4491479B2 (en) * | 2007-09-27 | 2010-06-30 | 株式会社日立製作所 | Distributed control system |
US8392088B2 (en) * | 2007-10-16 | 2013-03-05 | GM Global Technology Operations LLC | Brake assist driver command for vehicles |
US8364367B2 (en) * | 2007-10-16 | 2013-01-29 | GM Global Technology Operations LLC | Brake assist exit method and system for vehicles |
US8050836B2 (en) * | 2007-10-17 | 2011-11-01 | GM Global Technology Operations LLC | Method and system for determining initiation of a panic braking maneuver |
JP4886655B2 (en) * | 2007-10-30 | 2012-02-29 | 本田技研工業株式会社 | Vehicle behavior control device |
US8589049B2 (en) * | 2007-12-03 | 2013-11-19 | Lockheed Martin Corporation | GPS-based system and method for controlling vehicle characteristics based on terrain |
US20090143937A1 (en) * | 2007-12-04 | 2009-06-04 | Lockheed Martin Corporation | GPS-based traction control system using wirelessly received weather data |
US8145402B2 (en) * | 2007-12-05 | 2012-03-27 | Lockheed Martin Corporation | GPS-based traction control system and method using data transmitted between vehicles |
JP4633134B2 (en) * | 2008-03-27 | 2011-02-16 | ルネサスエレクトロニクス株式会社 | Microcontroller, control system, and design method of microcontroller |
KR20100007504A (en) * | 2008-07-14 | 2010-01-22 | 주식회사 만도 | A brake system for vehicle |
FR2934065B1 (en) * | 2008-07-17 | 2010-08-27 | Airbus France | DEVICE FOR DETERMINING THE POSITION OF A GAS LEVER IN AN AIRCRAFT |
US8234045B2 (en) * | 2008-09-24 | 2012-07-31 | Robert Bosch Gmbh | Failure mode effects mitigation in drive-by-wire systems |
US9604526B2 (en) * | 2008-12-05 | 2017-03-28 | Ford Global Technologies, Llc | Method for providing improved driveability for a vehicle |
US8401747B2 (en) * | 2008-12-19 | 2013-03-19 | Aisin Aw Co., Ltd. | Shift-by-wire device and transmission device mounting thereon the same |
DE102009010465B3 (en) * | 2009-02-13 | 2010-05-27 | Faro Technologies, Inc., Lake Mary | laser scanner |
US8229639B2 (en) * | 2009-02-17 | 2012-07-24 | Lockheed Martin Corporation | System and method for stability control |
US8352120B2 (en) * | 2009-02-17 | 2013-01-08 | Lockheed Martin Corporation | System and method for stability control using GPS data |
US8244442B2 (en) * | 2009-02-17 | 2012-08-14 | Lockheed Martin Corporation | System and method for stability control of vehicle and trailer |
DE102009015920B4 (en) | 2009-03-25 | 2014-11-20 | Faro Technologies, Inc. | Device for optically scanning and measuring an environment |
US9551575B2 (en) | 2009-03-25 | 2017-01-24 | Faro Technologies, Inc. | Laser scanner having a multi-color light source and real-time color receiver |
DE102009035336B3 (en) | 2009-07-22 | 2010-11-18 | Faro Technologies, Inc., Lake Mary | Device for optical scanning and measuring of environment, has optical measuring device for collection of ways as ensemble between different centers returning from laser scanner |
DE102009035337A1 (en) | 2009-07-22 | 2011-01-27 | Faro Technologies, Inc., Lake Mary | Method for optically scanning and measuring an object |
WO2011013217A1 (en) * | 2009-07-29 | 2011-02-03 | トヨタ自動車株式会社 | Steering control system |
US20110069606A1 (en) * | 2009-09-22 | 2011-03-24 | Electronics And Telecommunications Research Institute | Communication node and method of processing communication fault thereof |
DE102009055988B3 (en) | 2009-11-20 | 2011-03-17 | Faro Technologies, Inc., Lake Mary | Device, particularly laser scanner, for optical scanning and measuring surrounding area, has light transmitter that transmits transmission light ray by rotor mirror |
US9529083B2 (en) | 2009-11-20 | 2016-12-27 | Faro Technologies, Inc. | Three-dimensional scanner with enhanced spectroscopic energy detector |
DE102009057101A1 (en) | 2009-11-20 | 2011-05-26 | Faro Technologies, Inc., Lake Mary | Device for optically scanning and measuring an environment |
US9210288B2 (en) | 2009-11-20 | 2015-12-08 | Faro Technologies, Inc. | Three-dimensional scanner with dichroic beam splitters to capture a variety of signals |
US9113023B2 (en) | 2009-11-20 | 2015-08-18 | Faro Technologies, Inc. | Three-dimensional scanner with spectroscopic energy detector |
DE102009055989B4 (en) | 2009-11-20 | 2017-02-16 | Faro Technologies, Inc. | Device for optically scanning and measuring an environment |
US9163922B2 (en) | 2010-01-20 | 2015-10-20 | Faro Technologies, Inc. | Coordinate measurement machine with distance meter and camera to determine dimensions within camera images |
US9607239B2 (en) | 2010-01-20 | 2017-03-28 | Faro Technologies, Inc. | Articulated arm coordinate measurement machine having a 2D camera and method of obtaining 3D representations |
US8028432B2 (en) | 2010-01-20 | 2011-10-04 | Faro Technologies, Inc. | Mounting device for a coordinate measuring machine |
US9628775B2 (en) | 2010-01-20 | 2017-04-18 | Faro Technologies, Inc. | Articulated arm coordinate measurement machine having a 2D camera and method of obtaining 3D representations |
US9879976B2 (en) | 2010-01-20 | 2018-01-30 | Faro Technologies, Inc. | Articulated arm coordinate measurement machine that uses a 2D camera to determine 3D coordinates of smoothly continuous edge features |
JP5512331B2 (en) * | 2010-03-03 | 2014-06-04 | 積水化成品工業株式会社 | Foamed sheet and foamed resin container |
JP5086385B2 (en) * | 2010-03-08 | 2012-11-28 | 日立オートモティブシステムズ株式会社 | Electric power steering control device |
DE102010020925B4 (en) | 2010-05-10 | 2014-02-27 | Faro Technologies, Inc. | Method for optically scanning and measuring an environment |
KR101228492B1 (en) * | 2010-06-28 | 2013-01-31 | 현대모비스 주식회사 | Braking Control System for The Vehicle and Method of The same |
DE102010032725B4 (en) | 2010-07-26 | 2012-04-26 | Faro Technologies, Inc. | Device for optically scanning and measuring an environment |
DE102010032726B3 (en) | 2010-07-26 | 2011-11-24 | Faro Technologies, Inc. | Device for optically scanning and measuring an environment |
DE102010032723B3 (en) | 2010-07-26 | 2011-11-24 | Faro Technologies, Inc. | Device for optically scanning and measuring an environment |
DE102010033561B3 (en) | 2010-07-29 | 2011-12-15 | Faro Technologies, Inc. | Device for optically scanning and measuring an environment |
US8788149B2 (en) * | 2010-08-05 | 2014-07-22 | Toyota Jidosha Kabushiki Kaisha | Steering control device |
DE102010035823A1 (en) * | 2010-08-30 | 2012-03-01 | Liebherr-Aerospace Lindenberg Gmbh | Control organ system |
US9260087B2 (en) * | 2010-09-29 | 2016-02-16 | GM Global Technology Operations LLC | Regenerative braking system and method for controlling a regenerative braking system |
US9168654B2 (en) | 2010-11-16 | 2015-10-27 | Faro Technologies, Inc. | Coordinate measuring machines with dual layer arm |
FR2974689B1 (en) * | 2011-04-29 | 2013-04-19 | Renault Sa | DEVICE AND METHOD FOR REVERSIBLE CONVERSION OF MULTIFUNCTIONAL POWER |
US8655094B2 (en) * | 2011-05-11 | 2014-02-18 | The United States Of America As Represented By The Administrator Of The National Aeronautics And Space Administration | Photogrammetry system and method for determining relative motion between two bodies |
EP2525292A1 (en) * | 2011-05-20 | 2012-11-21 | ABB Technology AG | System and method for using redundancy of controller operation |
DE102011106163A1 (en) * | 2011-06-30 | 2013-01-03 | Lucas Automotive Gmbh | Device for protecting control system of motor vehicle, has microcontroller which generates control signal corresponding to the wheel output of wheel speed values such that the control system of motor vehicle is switched to safe state |
US9116516B2 (en) * | 2011-07-21 | 2015-08-25 | Abb Technology Ag | System and method for actuator control |
DE102011054848B4 (en) * | 2011-10-27 | 2014-06-26 | Deutsches Zentrum für Luft- und Raumfahrt e.V. | Control and monitoring device for vehicles |
US8847535B2 (en) | 2011-11-08 | 2014-09-30 | Autoliv Asp, Inc. | System and method to determine the operating status of an electrical system having a system controller and an actuator controller |
US9346428B2 (en) | 2011-11-22 | 2016-05-24 | Autoliv Asp, Inc. | System and method for determining when to deploy a vehicle safety system |
US20130201316A1 (en) | 2012-01-09 | 2013-08-08 | May Patents Ltd. | System and method for server based control |
DE102012200172B4 (en) * | 2012-01-09 | 2023-01-12 | Zf Friedrichshafen Ag | Method for operating a transmission device of a vehicle drive train with a prime mover |
DE102012100609A1 (en) | 2012-01-25 | 2013-07-25 | Faro Technologies, Inc. | Device for optically scanning and measuring an environment |
DE102012201185A1 (en) | 2012-01-27 | 2013-08-01 | Siemens Aktiengesellschaft | Method for operating at least two data processing units with high availability, in particular in a vehicle, and device for operating a machine |
US9522599B2 (en) * | 2012-03-19 | 2016-12-20 | GM Global Technology Operations LLC | Method for estimating parameters for a vehicle battery |
US9176500B1 (en) | 2012-05-14 | 2015-11-03 | Google Inc. | Consideration of risks in active sensing for an autonomous vehicle |
US8997362B2 (en) | 2012-07-17 | 2015-04-07 | Faro Technologies, Inc. | Portable articulated arm coordinate measuring machine with optical communications bus |
US9201720B2 (en) | 2012-08-13 | 2015-12-01 | Nxp B.V. | FlexRay network runtime error detection and containment |
DE102012107544B3 (en) | 2012-08-17 | 2013-05-23 | Faro Technologies, Inc. | Optical scanning device i.e. laser scanner, for evaluating environment, has planetary gears driven by motor over vertical motor shaft and rotating measuring head relative to foot, where motor shaft is arranged coaxial to vertical axle |
JP5925640B2 (en) * | 2012-08-31 | 2016-05-25 | Ntn株式会社 | Steer-by-wire steering reaction force control device |
DE102012109481A1 (en) | 2012-10-05 | 2014-04-10 | Faro Technologies, Inc. | Device for optically scanning and measuring an environment |
US10067231B2 (en) | 2012-10-05 | 2018-09-04 | Faro Technologies, Inc. | Registration calculation of three-dimensional scanner data performed between scans based on measurements by two-dimensional scanner |
US9513107B2 (en) | 2012-10-05 | 2016-12-06 | Faro Technologies, Inc. | Registration calculation between three-dimensional (3D) scans based on two-dimensional (2D) scan data from a 3D scanner |
AU2013341156B2 (en) | 2012-11-07 | 2016-02-25 | Polaris Industries Inc. | Vehicle having suspension with continuous damping control |
US9205717B2 (en) | 2012-11-07 | 2015-12-08 | Polaris Industries Inc. | Vehicle having suspension with continuous damping control |
KR101438606B1 (en) * | 2012-12-20 | 2014-09-15 | 현대자동차 주식회사 | Virtual sensor network system for convergence of heterogeneous sensors |
WO2014112049A1 (en) * | 2013-01-16 | 2014-07-24 | トヨタ自動車株式会社 | Control system for vehicle |
JP5919205B2 (en) * | 2013-01-28 | 2016-05-18 | 日立オートモティブシステムズ株式会社 | Network device and data transmission / reception system |
WO2014130717A1 (en) | 2013-02-22 | 2014-08-28 | Ellis Frampton | Failsafe devices, including transportation vehicles |
US9081382B2 (en) * | 2013-03-15 | 2015-07-14 | Fresenius Medical Care Holdings, Inc. | Autonomous vehicle comprising extracorporeal blood treatment machine |
JP2014200126A (en) * | 2013-03-29 | 2014-10-23 | 富士通株式会社 | Vehicle control system and drive control unit |
CN105209307B (en) * | 2013-05-13 | 2017-12-19 | 丰田自动车株式会社 | The brake control of vehicle |
US9292409B2 (en) * | 2013-06-03 | 2016-03-22 | Infineon Technologies Ag | Sensor interfaces |
DE102013015370A1 (en) * | 2013-09-13 | 2015-03-19 | Wabco Gmbh | Method for providing and transmitting data, in particular in connection with a vehicle |
US9096199B2 (en) * | 2013-10-09 | 2015-08-04 | Ford Global Technologies, Llc | Monitoring autonomous vehicle braking |
US9514581B2 (en) | 2014-01-03 | 2016-12-06 | Shem, Llc | Diagnostic system for a vehicle |
US9956967B2 (en) * | 2014-02-21 | 2018-05-01 | Siemens Aktiengesellschaft | Method for selecting multiple program functions, method for selecting one program function, associated apparatuses and associated vehicle, ship or aircraft |
US10422649B2 (en) | 2014-02-24 | 2019-09-24 | Ford Global Technologies, Llc | Autonomous driving sensing system and method |
US9626258B2 (en) * | 2014-03-26 | 2017-04-18 | Qualcomm Incorporated | Systems, methods, and apparatus related to wireless charging management |
DE102015206572A1 (en) * | 2014-05-15 | 2015-11-19 | Continental Teves Ag & Co. Ohg | Brake system for motor vehicles |
KR102051142B1 (en) * | 2014-06-13 | 2019-12-02 | 현대모비스 주식회사 | System for managing dangerous driving index for vehicle and method therof |
JP6274036B2 (en) * | 2014-07-01 | 2018-02-07 | 株式会社デンソー | Control device |
CN104149788B (en) * | 2014-07-25 | 2016-06-01 | 湖南大学 | A kind of electromobile prevents the method for officer's mishandle |
JP5898746B1 (en) * | 2014-09-29 | 2016-04-06 | 富士重工業株式会社 | Vehicle travel control device |
BR112017008825A2 (en) | 2014-10-31 | 2018-03-27 | Polaris Inc | method and power steering system for a vehicle, methods for controlling a power steering system of a vehicle and for controlling a vehicle, throttle replacement method for a recreational vehicle, and, vehicle. |
JP6187432B2 (en) | 2014-11-14 | 2017-08-30 | 株式会社デンソー | Control device |
WO2016116977A1 (en) * | 2015-01-20 | 2016-07-28 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ | Irregularity handling method and electronic control unit |
US10578465B2 (en) * | 2015-02-03 | 2020-03-03 | Infineon Technologies Ag | Sensor bus system and unit with internal event verification |
US10196069B2 (en) * | 2015-03-02 | 2019-02-05 | Surya Kiran Satyavolu | Methods and systems of algorithmically controlling automotive functions |
WO2016186942A1 (en) | 2015-05-15 | 2016-11-24 | Polaris Industries Inc. | Utility vehicle |
US20180162390A1 (en) * | 2015-06-03 | 2018-06-14 | Nissan Motor Co., Ltd. | Vehicle Control Device and Vehicle Control Method |
US9725037B2 (en) * | 2015-07-09 | 2017-08-08 | Nissan North America, Inc. | Message occlusion detection system and method in a vehicle-to-vehicle communication network |
US9598009B2 (en) | 2015-07-09 | 2017-03-21 | Nissan North America, Inc. | Vehicle intersection warning system and method with false alarm suppression |
KR102228331B1 (en) * | 2015-09-08 | 2021-03-15 | 현대자동차주식회사 | Operation method of communication node in network |
US9809210B2 (en) * | 2015-09-09 | 2017-11-07 | Cummins, Inc. | System and method for diagnosing failures in brake systems and discrete vehicle inputs |
US10000124B2 (en) * | 2015-11-04 | 2018-06-19 | Zoox, Inc. | Independent steering, power, torque control and transfer in vehicles |
US9802661B1 (en) | 2015-11-04 | 2017-10-31 | Zoox, Inc. | Quadrant configuration of robotic vehicles |
WO2017077807A1 (en) * | 2015-11-06 | 2017-05-11 | 本田技研工業株式会社 | Vehicle travel control device |
JP6698320B2 (en) * | 2015-11-16 | 2020-05-27 | 日立オートモティブシステムズ株式会社 | Processor and vehicle control system |
DE102015122844A1 (en) | 2015-12-27 | 2017-06-29 | Faro Technologies, Inc. | 3D measuring device with battery pack |
US10494789B2 (en) | 2016-01-06 | 2019-12-03 | Cnh Industrial America Llc | System and method for autonomous steering control of work vehicles |
DE102017200144B4 (en) * | 2016-01-22 | 2019-05-02 | Ford Global Technologies, Llc | Fallback mode of operation for a method of operating a motor vehicle having an active anti-roll bar and active steering |
FR3048218B1 (en) * | 2016-02-25 | 2018-03-23 | Renault S.A.S. | ELECTROMECHANICAL ARCHITECTURE OF MOTOR VEHICLE |
US9776630B2 (en) | 2016-02-29 | 2017-10-03 | Nissan North America, Inc. | Vehicle operation based on converging time |
US11265284B2 (en) * | 2016-03-18 | 2022-03-01 | Westinghouse Air Brake Technologies Corporation | Communication status system and method |
JP6258997B2 (en) * | 2016-03-31 | 2018-01-10 | 本田技研工業株式会社 | Vehicle control system |
JP6073003B1 (en) * | 2016-06-02 | 2017-02-01 | 三菱電機株式会社 | MOBILE BODY CONTROL DEVICE, MOBILE BODY CONTROL METHOD, AND MOBILE BODY CONTROL PROGRAM |
US10019009B2 (en) | 2016-06-15 | 2018-07-10 | Allstate Insurance Company | Vehicle control systems |
JP6846991B2 (en) * | 2016-07-05 | 2021-03-24 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカPanasonic Intellectual Property Corporation of America | Anomaly detection electronic control unit, in-vehicle network system and anomaly detection method |
DE102016112332B4 (en) * | 2016-07-06 | 2021-09-02 | Robert Bosch Gmbh | METHOD AND DEVICE FOR MONITORING A REGULATOR BLOCK FOR CONTROLLING AN ACTUATOR, IN PARTICULAR AN ACTUATOR OF A STEERING SYSTEM |
US10037698B2 (en) | 2016-07-28 | 2018-07-31 | Nissan North America, Inc. | Operation of a vehicle while suppressing fluctuating warnings |
GB2553121B (en) * | 2016-08-24 | 2019-02-06 | Jaguar Land Rover Ltd | Watchdog controller |
US11046330B1 (en) * | 2016-09-14 | 2021-06-29 | Apple Inc. | Redundant vehicle actuator system |
WO2018065409A1 (en) * | 2016-10-06 | 2018-04-12 | Jaguar Land Rover Limited | Steering system |
CN110121438B (en) | 2016-11-18 | 2023-01-31 | 北极星工业有限公司 | Vehicle with adjustable suspension |
JP6481676B2 (en) * | 2016-12-06 | 2019-03-13 | トヨタ自動車株式会社 | Hybrid vehicle |
JP6777761B2 (en) * | 2016-12-13 | 2020-10-28 | 日立オートモティブシステムズ株式会社 | Vehicle control unit |
DE102017200655A1 (en) | 2017-01-17 | 2018-07-19 | Audi Ag | Method for providing actuator-based vehicle functions in a motor vehicle and motor vehicle computing device and motor vehicle |
WO2018154860A1 (en) | 2017-02-23 | 2018-08-30 | 本田技研工業株式会社 | Vehicle control system |
JP6817410B2 (en) | 2017-02-23 | 2021-01-20 | 本田技研工業株式会社 | Vehicle control system and control method |
CN110325423B (en) | 2017-02-23 | 2023-05-02 | 本田技研工业株式会社 | Control system and control method for vehicle |
DE102017203748A1 (en) * | 2017-03-07 | 2018-09-13 | Volkswagen Aktiengesellschaft | Steer by wire system and data exchange procedure in a steer by wire system |
US10338594B2 (en) * | 2017-03-13 | 2019-07-02 | Nio Usa, Inc. | Navigation of autonomous vehicles to enhance safety under one or more fault conditions |
JP6743736B2 (en) * | 2017-03-23 | 2020-08-19 | トヨタ自動車株式会社 | Vehicle braking system |
JP6843665B2 (en) | 2017-03-24 | 2021-03-17 | 日立Astemo株式会社 | Automatic operation control device |
WO2018181808A1 (en) | 2017-03-31 | 2018-10-04 | 日信工業株式会社 | Vehicular brake system |
US20180292005A1 (en) * | 2017-04-06 | 2018-10-11 | GM Global Technology Operations LLC | Redundant hazard mitigation methods for an etrs controls architecture |
CN109005678B (en) | 2017-04-07 | 2022-05-27 | 松下电器(美国)知识产权公司 | Illegal communication detection method, illegal communication detection system, and recording medium |
JP6539363B2 (en) | 2017-04-07 | 2019-07-03 | パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカPanasonic Intellectual Property Corporation of America | Illegal communication detection method, illegal communication detection system and program |
US10423162B2 (en) | 2017-05-08 | 2019-09-24 | Nio Usa, Inc. | Autonomous vehicle logic to identify permissioned parking relative to multiple classes of restricted parking |
US10459436B2 (en) * | 2017-06-01 | 2019-10-29 | GM Global Technology Operations LLC | Asymmetric system architecture for fail-operational functions with limited availability requirements |
US10406884B2 (en) | 2017-06-09 | 2019-09-10 | Polaris Industries Inc. | Adjustable vehicle suspension system |
US11535266B2 (en) * | 2017-07-13 | 2022-12-27 | Danfoss Power Solutions Ii Technology A/S | Electromechanical controller for vehicles having a main processing module and a safety processing module |
US10710633B2 (en) | 2017-07-14 | 2020-07-14 | Nio Usa, Inc. | Control of complex parking maneuvers and autonomous fuel replenishment of driverless vehicles |
US10369974B2 (en) | 2017-07-14 | 2019-08-06 | Nio Usa, Inc. | Control and coordination of driverless fuel replenishment for autonomous vehicles |
CN111133412A (en) * | 2017-07-25 | 2020-05-08 | 奥罗拉实验室有限公司 | Software incremental update and anomaly detection for building vehicle ECU software based on tool chain |
US10569784B2 (en) * | 2017-09-28 | 2020-02-25 | Waymo Llc | Detecting and responding to propulsion and steering system errors for autonomous vehicles |
US20190168805A1 (en) * | 2017-12-04 | 2019-06-06 | GM Global Technology Operations LLC | Autonomous vehicle emergency steering profile during failed communication modes |
CN111727143B (en) * | 2017-12-20 | 2023-05-26 | 乐姆宝公开有限公司 | Brake-by-wire system for a vehicle |
CN113968289A (en) | 2018-01-10 | 2022-01-25 | 北极星工业有限公司 | Continuously variable transmission |
US11022971B2 (en) | 2018-01-16 | 2021-06-01 | Nio Usa, Inc. | Event data recordation to identify and resolve anomalies associated with control of driverless vehicles |
DE102018202659A1 (en) * | 2018-02-22 | 2019-08-22 | Zf Friedrichshafen Ag | Damping arrangement for power electronics applications |
US11014546B2 (en) * | 2018-03-29 | 2021-05-25 | Veoneer-Nissin Brake Systems Japan Co., Ltd. | Brake system and method for responding to external boost requests during predetermined loss or degraded boost assist conditions |
JP7458141B2 (en) * | 2018-05-22 | 2024-03-29 | ヤンマーパワーテクノロジー株式会社 | Work vehicles |
US10946736B2 (en) | 2018-06-05 | 2021-03-16 | Polaris Industries Inc. | All-terrain vehicle |
WO2019244269A1 (en) * | 2018-06-20 | 2019-12-26 | 三菱電機株式会社 | Automated operating assistance system and operation method therefor |
JP7035843B2 (en) * | 2018-06-26 | 2022-03-15 | トヨタ自動車株式会社 | Vehicle steering system |
CN109270832B (en) * | 2018-08-30 | 2022-04-12 | 阿波罗智能技术(北京)有限公司 | Unmanned vehicle control method, device, equipment and storage medium |
JP7091949B2 (en) | 2018-08-30 | 2022-06-28 | トヨタ自動車株式会社 | Vehicle control unit |
JP7059899B2 (en) | 2018-11-09 | 2022-04-26 | トヨタ自動車株式会社 | Network system |
US10987987B2 (en) | 2018-11-21 | 2021-04-27 | Polaris Industries Inc. | Vehicle having adjustable compression and rebound damping |
US11524695B2 (en) * | 2019-01-23 | 2022-12-13 | Motional Ad Llc | Interface for harmonizing performance of different autonomous vehicles in a fleet |
WO2020158350A1 (en) * | 2019-01-31 | 2020-08-06 | 日本精工株式会社 | Actuator control device used in steering of vehicle |
DE102019104392B4 (en) * | 2019-02-21 | 2020-12-03 | Schaeffler Technologies AG & Co. KG | Motor vehicle with driven wheels on several axles and method for its control |
US10896555B2 (en) | 2019-03-29 | 2021-01-19 | Toyota Motor North America, Inc. | Vehicle data sharing with interested parties |
US10535207B1 (en) | 2019-03-29 | 2020-01-14 | Toyota Motor North America, Inc. | Vehicle data sharing with interested parties |
US10726642B1 (en) | 2019-03-29 | 2020-07-28 | Toyota Motor North America, Inc. | Vehicle data sharing with interested parties |
US11157004B2 (en) * | 2019-04-01 | 2021-10-26 | GM Global Technology Operations LLC | Real-time control system for a vehicle and a method of executing control of the vehicle via the real-time control system |
JP7250601B2 (en) | 2019-04-17 | 2023-04-03 | 日立Astemo株式会社 | vehicle control system |
US11148678B2 (en) * | 2019-04-26 | 2021-10-19 | GM Global Technology Operations LLC | Controlling operation of a vehicle with a supervisory control module having a fault-tolerant controller |
JP7215315B2 (en) * | 2019-04-26 | 2023-01-31 | トヨタ自動車株式会社 | vehicle system |
JP7392293B2 (en) * | 2019-06-06 | 2023-12-06 | マツダ株式会社 | Vehicle failure diagnosis device |
US11142212B2 (en) | 2019-06-06 | 2021-10-12 | Nxp B.V. | Safety-aware comparator for redundant subsystems in autonomous vehicles |
CN110182220B (en) * | 2019-06-10 | 2020-08-18 | 英博超算(南京)科技有限公司 | Control method and system for automatically driving vehicle |
KR102167906B1 (en) * | 2019-06-20 | 2020-10-20 | 주식회사 만도 | Apparatus for controlling steering and System for assisting steering including it |
CN112224217B (en) * | 2019-06-30 | 2021-09-03 | 比亚迪股份有限公司 | Integrated control chip, environment recognition method and device, storage medium and vehicle |
US11708106B2 (en) * | 2019-07-02 | 2023-07-25 | Cnh Industrial America Llc | Steering systems and methods using active braking |
JP7120171B2 (en) * | 2019-07-09 | 2022-08-17 | トヨタ自動車株式会社 | In-vehicle network system |
DE102019120028A1 (en) * | 2019-07-24 | 2021-01-28 | Schaeffler Technologies AG & Co. KG | Circuit device for controlling a motor |
US11260803B2 (en) | 2019-07-26 | 2022-03-01 | Polaris Industries Inc. | Audio system for a utility vehicle |
JP7342495B2 (en) * | 2019-07-30 | 2023-09-12 | マツダ株式会社 | vehicle control system |
US11529918B2 (en) | 2019-09-02 | 2022-12-20 | Toyota Motor North America, Inc. | Adjustment of environment of transports |
CN110764944B (en) * | 2019-10-22 | 2023-05-16 | 东软睿驰汽车技术(沈阳)有限公司 | Abnormality detection method and device |
CN111025959B (en) * | 2019-11-20 | 2021-10-01 | 华为技术有限公司 | Data management method, device and equipment and intelligent automobile |
US11235885B2 (en) * | 2019-12-20 | 2022-02-01 | Pratt & Whitney Canada Corp. | Method and system for determining a throttle position of an aircraft |
JP7459532B2 (en) * | 2020-01-31 | 2024-04-02 | トヨタ自動車株式会社 | vehicle |
US11318920B2 (en) * | 2020-02-28 | 2022-05-03 | Bendix Commercial Vehicle Systems Llc | Brake controller storing deceleration profiles and method using deceleration profiles stored in a brake controller |
US11210571B2 (en) | 2020-03-13 | 2021-12-28 | Argo AI, LLC | Using rasterization to identify traffic signal devices |
US11704912B2 (en) | 2020-06-16 | 2023-07-18 | Ford Global Technologies, Llc | Label-free performance evaluator for traffic light classifier system |
US11505176B2 (en) * | 2020-06-30 | 2022-11-22 | Rivian Ip Holdings, Llc | Systems and methods for controlling torque induced yaw in a vehicle |
KR20220001922A (en) * | 2020-06-30 | 2022-01-06 | 현대자동차주식회사 | Method and apparatus for controlling autonomous driving |
MX2022015902A (en) | 2020-07-17 | 2023-01-24 | Polaris Inc | Adjustable suspensions and vehicle operation for off-road recreational vehicles. |
CN111976828A (en) * | 2020-08-19 | 2020-11-24 | 南京金龙客车制造有限公司 | Double-source switching control system and method for steering system |
CN111959521B (en) * | 2020-08-25 | 2021-11-12 | 厦门理工学院 | Unmanned vehicle control system |
JP7484633B2 (en) * | 2020-09-30 | 2024-05-16 | 株式会社デンソー | Shared storage management device and shared storage management method |
CN112298208B (en) * | 2020-10-21 | 2022-05-17 | 长城汽车股份有限公司 | Automatic driving transverse auxiliary control method and transverse auxiliary system |
JP2022095041A (en) * | 2020-12-16 | 2022-06-28 | 株式会社Subaru | Vehicle control device |
CN112622935B (en) * | 2020-12-30 | 2022-04-19 | 一汽解放汽车有限公司 | Automatic vehicle driving method and device, vehicle and storage medium |
US11465636B2 (en) * | 2021-02-01 | 2022-10-11 | Ree Automotive Ltd. | Control systems for vehicle corner modules and methods of operation |
KR20220128566A (en) * | 2021-03-12 | 2022-09-21 | 현대모비스 주식회사 | Integrated electronic brake apparatus for control method thereof |
JP2022146034A (en) * | 2021-03-22 | 2022-10-05 | 本田技研工業株式会社 | Vehicle control device |
US12012097B2 (en) | 2021-07-29 | 2024-06-18 | Ford Global Technologies, Llc | Complementary control system for an autonomous vehicle |
US11607952B1 (en) * | 2022-05-04 | 2023-03-21 | Dimaag-Ai, Inc. | Methods and systems for controlling differential wheel speeds of multi- independent-wheel drive vehicles |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH10291489A (en) | 1997-04-22 | 1998-11-04 | Nissin Kogyo Kk | Interlocking brake device for vehicle |
JP2002347602A (en) | 2001-04-12 | 2002-12-04 | Robert Bosch Gmbh | Electric brake device for automobile |
US20030120401A1 (en) | 2000-07-01 | 2003-06-26 | Wolf-Dietrich Bauer | Vehicle control system and method for controlling a vehicle |
JP2003263235A (en) | 2002-03-11 | 2003-09-19 | Toyota Motor Corp | Operation control apparatus for vehicle |
Family Cites Families (61)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
SU874402A1 (en) * | 1979-12-04 | 1981-10-23 | Белорусский Ордена Трудового Красного Знамени Политехнический Институт | Central syncronization system for vehicle stepped mechanical transmission |
JPS61232763A (en) * | 1985-04-09 | 1986-10-17 | Dainippon Screen Mfg Co Ltd | Device for correcting light quantity nonuniformity of copying optical system |
JP3117442B2 (en) | 1988-07-07 | 2000-12-11 | 株式会社日立製作所 | Vehicle control device |
JP2895516B2 (en) | 1989-08-28 | 1999-05-24 | トヨタ自動車株式会社 | Suspension control device |
DE3902849A1 (en) * | 1989-02-01 | 1990-08-02 | Vdo Schindling | Circuit arrangement for exchange of data between two microcomputers |
GB2251499A (en) * | 1991-01-05 | 1992-07-08 | Delco Electronics Corp | Electronic control module. |
DE4129809C2 (en) * | 1991-01-28 | 2000-08-17 | Bosch Gmbh Robert | Multi-computer system |
JP2658600B2 (en) | 1991-01-30 | 1997-09-30 | 日産自動車株式会社 | Vehicle control device |
JPH05248528A (en) | 1992-03-05 | 1993-09-24 | Toyota Motor Corp | Speed change controller of automatic transmission |
JP2746002B2 (en) | 1992-08-28 | 1998-04-28 | トヨタ自動車株式会社 | Driving force distribution device for four-wheel drive vehicle with four-wheel steering device |
JPH09160643A (en) | 1995-12-11 | 1997-06-20 | Toyota Motor Corp | Diagnostic system for vehicle |
JP3301325B2 (en) | 1996-11-18 | 2002-07-15 | トヨタ自動車株式会社 | Vehicle state quantity acquisition device |
US5957985A (en) * | 1996-12-16 | 1999-09-28 | Microsoft Corporation | Fault-resilient automobile control system |
DE19709319A1 (en) | 1997-03-07 | 1998-09-10 | Bosch Gmbh Robert | Motor vehicle controlling method |
DE19735015B4 (en) | 1997-08-13 | 2016-11-24 | Volkswagen Ag | Method and device for safety strategies in motor vehicles |
JP3383761B2 (en) * | 1997-12-19 | 2003-03-04 | 株式会社日立製作所 | Heating resistor type air flow measurement device |
IT1303625B1 (en) * | 1998-07-24 | 2000-11-15 | Gruppi Pinasco S R L | VARIABLE SPEED LIMITER FOR MOTOR VEHICLES WITH ELECTRONIC IGNITION. |
FR2784061B1 (en) * | 1998-10-02 | 2000-10-27 | Renault | TRANSMISSION COMPRISING A HALL EFFECT SENSOR |
JP3390360B2 (en) | 1999-03-16 | 2003-03-24 | 三菱電機株式会社 | Electric power steering device |
JP3757674B2 (en) | 1999-04-12 | 2006-03-22 | 日産自動車株式会社 | Vehicle driving force control device |
US6421790B1 (en) * | 1999-05-10 | 2002-07-16 | Delphi Technologies, Inc. | Method and circuit for analysis of the operation of a microcontroller using signature analysis of data and instructions |
US6981176B2 (en) * | 1999-05-10 | 2005-12-27 | Delphi Technologies, Inc. | Secured microcontroller architecture |
US6625688B1 (en) * | 1999-05-10 | 2003-09-23 | Delphi Technologies, Inc. | Method and circuit for analysis of the operation of a microcontroller using signature analysis of memory |
US6415394B1 (en) * | 1999-05-10 | 2002-07-02 | Delphi Technologies, Inc. | Method and circuit for analysis of the operation of a microcontroller using signature analysis during operation |
JP4723706B2 (en) * | 1999-09-02 | 2011-07-13 | トヨタ自動車株式会社 | Electric control system for vehicles |
IL132663A (en) * | 1999-10-31 | 2004-06-01 | Insyt Ltd | Knowledge-engineering protocol-suite |
JP2001161091A (en) * | 1999-11-30 | 2001-06-12 | Ito Denki Kk | Control method for motor roller |
US6463366B2 (en) * | 2000-03-10 | 2002-10-08 | Schafer Corp | Attitude determination and alignment using electro-optical sensors and global navigation satellites |
CN2418058Y (en) | 2000-04-19 | 2001-02-07 | 姚天锡 | Freight carrier having foldable tarpaulin |
CN2418068Y (en) | 2000-04-30 | 2001-02-07 | 刘长春 | Anti-blocked braking device for automobile |
JP2002041142A (en) | 2000-07-27 | 2002-02-08 | Denso Corp | Monitoring system, fail/safe system and recording medium |
JP2002053024A (en) | 2000-08-09 | 2002-02-19 | Unisia Jecs Corp | Vehicle behavior detecting device |
JP3458839B2 (en) | 2000-11-20 | 2003-10-20 | トヨタ自動車株式会社 | Road surface maximum friction coefficient estimation device |
DE10058899B4 (en) * | 2000-11-22 | 2012-09-13 | Volkswagen Ag | X-by-wire system and procedures for its operation |
DE10112514A1 (en) * | 2000-12-22 | 2002-06-27 | Volkswagen Ag | X-by-wire system for vehicle has redundant modules in units with first modules networked to form subsystem, likewise second modules; second subsystem consists only of second modules |
JP4399987B2 (en) * | 2001-01-25 | 2010-01-20 | 株式会社デンソー | Fail-safe system for vehicle integrated control |
JP2002347479A (en) * | 2001-05-29 | 2002-12-04 | Denso Corp | Vehicle integrated control system |
JP4622177B2 (en) | 2001-07-06 | 2011-02-02 | 株式会社デンソー | Failure diagnosis system, vehicle management device, server device, and inspection diagnosis program |
JP3937774B2 (en) | 2001-09-05 | 2007-06-27 | 三菱ふそうトラック・バス株式会社 | Vehicle constant speed travel control device |
WO2004000598A1 (en) * | 2002-06-24 | 2003-12-31 | Denso Corporation | Vehicle control information transmission structure, vehicle control device using the transmission structure, and vehicle control simulator using the transmission structure |
US6729844B2 (en) * | 2002-08-14 | 2004-05-04 | Harold Ray Bettencourt | Controller for variable pitch fan system |
US7245995B2 (en) * | 2003-02-19 | 2007-07-17 | Robert Bosch Gmbh | Fault-tolerant vehicle stability control |
US20050030009A1 (en) * | 2003-06-24 | 2005-02-10 | Moreno Daniel J. | Discrete absolute sensor and code |
JP4155198B2 (en) | 2004-01-19 | 2008-09-24 | トヨタ自動車株式会社 | Abnormality detection device for vehicle control system |
DE102004003302A1 (en) * | 2004-01-22 | 2005-08-18 | Robert Bosch Gmbh | Device for powering a hybrid vehicle with at least one x-by-wire system |
DE602005019499D1 (en) * | 2004-07-15 | 2010-04-08 | Hitachi Ltd | Vehicle control system |
US8285451B2 (en) * | 2005-03-17 | 2012-10-09 | Nsk Ltd. | Method and apparatus for controlling electric power steering system |
US20060231301A1 (en) * | 2005-04-19 | 2006-10-19 | Rose Timothy L | Coast control for motorized pallet truck |
US20100019963A1 (en) * | 2006-06-15 | 2010-01-28 | Uti Limited Partnership | Vehicular navigation and positioning system |
US7831352B2 (en) * | 2007-03-16 | 2010-11-09 | The Hartfiel Company | Hydraulic actuator control system |
DE102007013511A1 (en) * | 2007-03-21 | 2008-09-25 | Audi Ag | Motor vehicle with an X-by-wire system and method for operating an X-by-wire system of a motor vehicle |
US7855678B2 (en) * | 2007-05-16 | 2010-12-21 | Trimble Navigation Limited | Post-mission high accuracy position and orientation system |
US20090005986A1 (en) * | 2007-06-26 | 2009-01-01 | Honeywell International Inc. | Low power inertial navigation processing |
JP2009247181A (en) * | 2008-03-31 | 2009-10-22 | Jtekt Corp | Motor control device and electric power steering device |
JP5297126B2 (en) * | 2008-09-11 | 2013-09-25 | 本田技研工業株式会社 | Electric power steering device |
US8886453B2 (en) * | 2008-12-11 | 2014-11-11 | Telogis, Inc. | System and method for efficient routing on a network in the presence of multiple-edge restrictions and other constraints |
FR2944612A3 (en) * | 2009-04-15 | 2010-10-22 | Renault Sas | Electronic control architecture e.g. braking system, for motor vehicle, has voting device counting number of messages and deactivating actuator when number is higher than or equal to threshold that is equal to number of monitoring units |
JP5446934B2 (en) * | 2010-01-28 | 2014-03-19 | 株式会社デンソー | Vehicle drive control device and travel section specifying device |
US8930136B2 (en) * | 2010-04-08 | 2015-01-06 | Texas Instruments Incorporated | Static heading detection in personal navigation device |
US20140310610A1 (en) * | 2013-04-15 | 2014-10-16 | Flextronics Ap, Llc | Vehicle occupant impairment assisted vehicle |
JP5928320B2 (en) * | 2012-12-07 | 2016-06-01 | 株式会社日立製作所 | Navigation system for electric vehicles |
-
2005
- 2005-03-31 DE DE602005019499T patent/DE602005019499D1/en active Active
- 2005-03-31 EP EP05007078A patent/EP1616746B1/en active Active
- 2005-03-31 EP EP10150630.1A patent/EP2177413B1/en active Active
- 2005-03-31 US US11/094,660 patent/US7630807B2/en active Active
-
2009
- 2009-10-07 US US12/575,212 patent/US8645022B2/en active Active
-
2013
- 2013-12-30 US US14/143,631 patent/US20140188343A1/en not_active Abandoned
-
2014
- 2014-12-15 US US14/570,485 patent/US9650038B2/en active Active
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH10291489A (en) | 1997-04-22 | 1998-11-04 | Nissin Kogyo Kk | Interlocking brake device for vehicle |
US20030120401A1 (en) | 2000-07-01 | 2003-06-26 | Wolf-Dietrich Bauer | Vehicle control system and method for controlling a vehicle |
JP2002347602A (en) | 2001-04-12 | 2002-12-04 | Robert Bosch Gmbh | Electric brake device for automobile |
JP2003263235A (en) | 2002-03-11 | 2003-09-19 | Toyota Motor Corp | Operation control apparatus for vehicle |
Non-Patent Citations (1)
Title |
---|
"Seminar", D&M NIKKEI MECHANICAL, article "X-by-Wire", pages: 3 - 6 |
Cited By (45)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1850229A1 (en) * | 2006-04-28 | 2007-10-31 | Marquardt GmbH | Device and method for controlling a functional unit in a vehicle |
FR2941547A1 (en) * | 2009-01-28 | 2010-07-30 | Peugeot Citroen Automobiles Sa | Logic controller for e.g. fans, in engine of motor vehicle, has corrector module generating corrected signal if properties of control signal are not satisfied, where corrected signal is applied on actuator if properties are not satisfied |
EP2372247A3 (en) * | 2010-03-30 | 2014-03-12 | Azbil Corporation | Combustion controlling device |
EP2583879A4 (en) * | 2010-06-18 | 2018-06-27 | Hitachi Automotive Systems, Ltd. | Electronic control device |
FR2972168A1 (en) * | 2011-03-02 | 2012-09-07 | Akka Ingenierie Produit | Decoupled steering control system i.e. steer-by-wire type control system, for controlling steering of wheels in e.g. front axle in car, has determination unit determining average maximum steering angle to be applied on wheels |
WO2013013928A1 (en) * | 2011-07-22 | 2013-01-31 | Continental Automotive Gmbh | Steering system for a motor vehicle |
EP2587330B1 (en) | 2011-10-27 | 2019-07-31 | Diehl Defence GmbH & Co. KG | Control device for at least partially autonomous operation of a vehicle and vehicle with such a control device |
WO2014079440A1 (en) * | 2012-11-20 | 2014-05-30 | Conti Temic Microelectronic Gmbh | Method for a driver assistance application |
US9481374B2 (en) | 2012-11-20 | 2016-11-01 | Conti Temic Microelectronic Gmbh | Method for a driver assistance application |
EP2808454A3 (en) * | 2013-05-30 | 2015-08-26 | Sinfonia Technology Co., Ltd. | Motor controller for construction machines |
US9287808B2 (en) | 2013-05-30 | 2016-03-15 | Sinfonia Technology Co., Ltd. | Motor controller and construction machine provided therewith |
KR20210082405A (en) * | 2013-07-19 | 2021-07-05 | 현대모비스 주식회사 | Method and apparatus for processing radar signal of vehicle |
WO2015124379A1 (en) * | 2014-02-18 | 2015-08-27 | Jaguar Land Rover Limited | Control system and method |
US10059339B2 (en) | 2014-02-18 | 2018-08-28 | Jaguar Land Rover Limited | Control system and method |
WO2015185258A1 (en) * | 2014-06-03 | 2015-12-10 | Robert Bosch Gmbh | Method and device for monitoring a system of a vehicle that provides an at least partially automated driving function |
US9971349B2 (en) | 2014-06-03 | 2018-05-15 | Robert Bosch Gmbh | Method and device for monitoring a system of a vehicle which provides an at least partially automated driving function |
EP3150452A1 (en) * | 2015-10-01 | 2017-04-05 | Peugeot Citroën Automobiles SA | Test of a function for controlling the trajectory of a vehicle using the brakes without controlling the steering wheel |
FR3041915A1 (en) * | 2015-10-01 | 2017-04-07 | Peugeot Citroen Automobiles Sa | METHOD FOR CONTROLLING THE TRACK OF A VEHICLE WITH BRAKES WITHOUT DIRECTION OF THE STEERING WHEEL |
FR3041919A1 (en) * | 2015-10-01 | 2017-04-07 | Peugeot Citroen Automobiles Sa | TESTING A CONTROL FUNCTION OF THE TRACK OF A VEHICLE WITH BRAKES WITHOUT STEERING CONTROL |
EP3150451A1 (en) * | 2015-10-01 | 2017-04-05 | Peugeot Citroën Automobiles SA | Method for controlling the trajectory of a vehicle using the brakes, without controlling the steering wheel |
CN110799404A (en) * | 2017-04-17 | 2020-02-14 | 移动眼视力科技有限公司 | Safety system comprising driving-related system |
US11951998B2 (en) | 2017-04-17 | 2024-04-09 | Mobileye Vision Technologies Ltd. | Secure system that includes driving related systems |
EP4186769A1 (en) * | 2017-04-17 | 2023-05-31 | Mobileye Vision Technologies Ltd. | Secure system that includes driving related systems |
US11608073B2 (en) | 2017-04-17 | 2023-03-21 | Mobileye Vision Technologies Ltd. | Secure system that includes driving related systems |
WO2018193449A1 (en) * | 2017-04-17 | 2018-10-25 | Mobileye Vision Technologies Ltd. | Secure system that includes driving related systems |
CN108859861A (en) * | 2017-05-11 | 2018-11-23 | 杭州长江汽车有限公司 | A kind of control system of electric vehicle, control method and electric vehicle |
WO2019125281A1 (en) * | 2017-12-18 | 2019-06-27 | Komatsu Forest Ab | Work machine and method for monitoring a control system at a work machine |
SE1751567A1 (en) * | 2017-12-18 | 2019-06-19 | Komatsu Forest Ab | Work machine and method for monitoring a control system at a work machine |
RU2776166C2 (en) * | 2017-12-18 | 2022-07-14 | Комацу Форест Аб | Working machine and method for monitoring control system on working machine |
US11601454B2 (en) | 2017-12-18 | 2023-03-07 | Komatsu Forest Ab | Work machine and method for monitoring a control system at a work machine |
EP3786021A4 (en) * | 2018-04-25 | 2021-06-30 | Denso Corporation | Vehicle control device |
US11597526B2 (en) | 2019-04-25 | 2023-03-07 | Pratt & Whitney Canada Corp. | Control systems for hybrid electric powerplants |
WO2020219111A1 (en) | 2019-04-25 | 2020-10-29 | United Technologies Corporation | Control systems for hybrid electric powerplants |
EP3927620A4 (en) * | 2019-04-25 | 2022-11-16 | Pratt & Whitney Canada Corp. | Control systems for hybrid electric powerplants |
CN114174123A (en) * | 2019-07-30 | 2022-03-11 | 马自达汽车株式会社 | Vehicle control system |
US12043308B2 (en) | 2019-07-30 | 2024-07-23 | Mazda Motor Corporation | Vehicle control system |
EP3998182A4 (en) * | 2019-07-30 | 2022-08-24 | Mazda Motor Corporation | Vehicle control system |
US20230040044A1 (en) * | 2020-04-20 | 2023-02-09 | Thyssenkrupp Presta Ag | Degradation concept for a steer-by-wire steering system |
WO2022136590A1 (en) * | 2020-12-23 | 2022-06-30 | Haldex Vie (Shanghai) Electromechanical Brake System Co., Ltd. | A vehicle's brake system and a method for braking a vehicle |
WO2022136597A1 (en) * | 2020-12-23 | 2022-06-30 | Haldex Vie (Shanghai) Electromechanical Brake System Co., Ltd. | A control method for automatic holding, a vehicle's brake system and a brake control module thereof |
EP4019348A1 (en) * | 2020-12-28 | 2022-06-29 | Hitachi Astemo Netherlands B.V. | Brake system and method for braking a vehicle |
WO2022146140A1 (en) * | 2020-12-28 | 2022-07-07 | Hitachi Astemo Netherlands B.V. | Brake system and method for braking a vehicle |
FR3119139A1 (en) * | 2021-01-22 | 2022-07-29 | Transdev Group Innovation | Control equipment capable of controlling a steering angle of an autonomous motor vehicle and autonomous motor vehicle comprising such equipment |
EP4032784A1 (en) * | 2021-01-22 | 2022-07-27 | Transdev Group Innovation | Control device capable of controlling an angle of locking of an autonomous motor vehicle and autonomous motor vehicle comprising such a device |
EP4169807A1 (en) * | 2021-10-21 | 2023-04-26 | Jtekt Corporation | Steer-by-wire steering system |
Also Published As
Publication number | Publication date |
---|---|
EP1616746B1 (en) | 2010-02-24 |
EP2177413A2 (en) | 2010-04-21 |
EP2177413B1 (en) | 2015-02-25 |
US8645022B2 (en) | 2014-02-04 |
US20060015231A1 (en) | 2006-01-19 |
US7630807B2 (en) | 2009-12-08 |
DE602005019499D1 (en) | 2010-04-08 |
US20150100207A1 (en) | 2015-04-09 |
EP1616746A3 (en) | 2008-01-23 |
US20100030421A1 (en) | 2010-02-04 |
US20140188343A1 (en) | 2014-07-03 |
US9650038B2 (en) | 2017-05-16 |
EP2177413A3 (en) | 2011-02-16 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP2177413B1 (en) | Vehicle control system | |
JP6214730B2 (en) | Vehicle control system | |
JP4478037B2 (en) | Vehicle control device | |
CN100545771C (en) | Controller of vehicle | |
RU2765067C2 (en) | Information processing apparatus | |
JP4341553B2 (en) | Vehicle control information transmission structure, vehicle control apparatus using the transmission structure, and vehicle control simulator using the transmission structure | |
CA2551048C (en) | Vehicle integrated control system | |
CN110099826B (en) | Electronic system for controlling traction and braking of a vehicle and related method | |
WO2016111328A1 (en) | Vehicle control device | |
JP2024505097A (en) | Control system and operating method for vehicle corner module | |
CN111605410A (en) | Electric control braking system and electric control braking method | |
EP4200174A1 (en) | Brake system for a vehicle and method for braking | |
US7013209B2 (en) | Operating a multimode ABS | |
CN117508160A (en) | Control device, manager, method, non-transitory storage medium, vehicle control device, and vehicle control method | |
JP4528457B2 (en) | Brake device for automobile and control method thereof | |
CN115384528A (en) | Centralized chassis domain control architecture and method | |
CN115250618A (en) | Method for controlling a motor vehicle drive train comprising at least two drive power sources | |
CN112849132A (en) | Vehicle control device | |
Holzmann et al. | Actuators and drive train architecture |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
AK | Designated contracting states |
Kind code of ref document: A2 Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU MC NL PL PT RO SE SI SK TR |
|
AX | Request for extension of the european patent |
Extension state: AL BA HR LV MK YU |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: B62D 6/00 20060101ALI20070928BHEP Ipc: G06F 11/07 20060101ALI20070928BHEP Ipc: B60T 7/12 20060101ALI20070928BHEP Ipc: G06F 15/173 20060101ALI20070928BHEP Ipc: B60K 31/04 20060101AFI20051020BHEP Ipc: G06F 11/00 20060101ALI20070928BHEP |
|
PUAL | Search report despatched |
Free format text: ORIGINAL CODE: 0009013 |
|
AK | Designated contracting states |
Kind code of ref document: A3 Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU MC NL PL PT RO SE SI SK TR |
|
AX | Request for extension of the european patent |
Extension state: AL BA HR LV MK YU |
|
17P | Request for examination filed |
Effective date: 20080331 |
|
17Q | First examination report despatched |
Effective date: 20080725 |
|
AKX | Designation fees paid |
Designated state(s): DE FR IT |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
GRAS | Grant fee paid |
Free format text: ORIGINAL CODE: EPIDOSNIGR3 |
|
GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): DE FR IT |
|
REF | Corresponds to: |
Ref document number: 602005019499 Country of ref document: DE Date of ref document: 20100408 Kind code of ref document: P |
|
PLBE | No opposition filed within time limit |
Free format text: ORIGINAL CODE: 0009261 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT |
|
26N | No opposition filed |
Effective date: 20101125 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20100224 |
|
REG | Reference to a national code |
Ref country code: FR Ref legal event code: ST Effective date: 20110422 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: FR Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20100426 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R081 Ref document number: 602005019499 Country of ref document: DE Owner name: HITACHI ASTEMO, LTD., HITACHINAKA-SHI, JP Free format text: FORMER OWNER: HITACHI AUTOMOTIVE SYSTEMS, LTD., HITACHINAKA-SHI, IBARAKI, JP Ref country code: DE Ref legal event code: R081 Ref document number: 602005019499 Country of ref document: DE Owner name: HITACHI ASTEMO, LTD., HITACHINAKA-SHI, JP Free format text: FORMER OWNER: HITACHI, LTD., TOKYO, JP |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: DE Payment date: 20230131 Year of fee payment: 19 |